 |
» |
|
|
|
This section describes the requirements and steps on how to
prepare Active Directory to work with LDAP-UX Client Services. | | | |  | NOTE: If you will be configuring your system for ADS multiple
domains, there will be some additional configuration instructions
to follow. These are listed under the appropriate step number. | | | | |
Step 1:
Install Active Directory | |
Even though Active Directory is an integral component of the
Windows 2000 operating system, it must be installed separately after
the Windows 2000 Server installation has been completed on your
computer. After the final reboot of the Windows 2000 installation: The Windows 2000 Configure Your Server screen
is displayed, select Active Directory (in
the left column). Click Start to
initiate the Active Directory Installation Wizard. | | | | | NOTE: You can also initiate the Active Directory Installation
Wizard at any future time, by clicking on Start, Programs, Administrative Tools, Configure Your Server. Choose Active Directory and click on Start. | | | | |
Install any additional Administrative
tools required for you to manage Active Directory. These Windows
2000 Administrative tools are included with Windows 2000 Server
to simplify directory administration, but they must be installed
separately if your system is running Windows 2000 Professional.
The following tools may be required: Make
sure you have Active Directory Users and Computers which is needed
to manage user accounts. The Active Directory Schema
snap-in allows you to manage your Active Directory schema. For installation
information, refer to the Active Directory on-line Help “Manage
the schema”. Active Directory Services
interface (ADSI) editor is part of Windows 2000 Support Tools and
is used to create and modify Active Directory objects. The Windows 2000 Support Tools can be found on the
Windows 2000 Server CD. Click on support/tools/setup to start the setup wizard.
If ADS multiple domains will
be used, set up the ADS forest. Ideally, the local domain should
contain the most frequently accessed data.
Step
2: Install SFU 2.0 or 3.0 including Server for NIS | |
POSIX accounts have some attributes, such as user ID, login
shell, and home directory, which are not used by Windows 2000. To
use Active Directory as a data repository for HP-UX users, the Active
Directory schema needs to be extended to include the POSIX schema
defined in RFC 2307. Server for NIS, a tool available with the Services
for Unix (SFU) add-on package, extends the Active Directory schema
based on RFC 2307 to allow integration of POSIX attributes. For corresponding Windows objects that exist in Active Directory
(such as password and group), Server for NIS adds POSIX attributes
to the same object creating a unique object representing both POSIX and Windows
identities. For example, information needed for a UNIX user is stored
in Active Directory as part of the Active Directory Domain Users
group. To allow storing POSIX attributes, Server for NIS extends
the Users group with msSFUPosixAccount as its auxiliary class (SFU
version 2.0). This allows POSIX attributes to be added to newly
created objects of the User class. | | | | | NOTE: Version of SFU above 2.0 include the version string
in these attribute names (i.e. msSFU30IpService). | | | | |
More information on SFU can be found on the Microsoft web
site at http://www.microsoft.com/windows2000/sfu/. Step
3: Create a Proxy User | |
The use of a proxy user is mandatory for Active Directory,
as anonymous binding done not grant enough access rights to retrieve
user, group, or any other name service data. Use the Windows 2000 management tool, Active
Directory Users and Computers,
to add a proxy user as a member of the "Domain Users" group. For
example, you might add a user:
CN=Proxy User, DC=Users, DC=cup, DC=hp, DC=com | | | |  | CAUTION: Make sure the proxy user is a member of the Domain
Users group, which allows read access only, and not the Administrator
group to protect Active Directory entries from malicious modifications. | | | | |
A proxy user’s access right to objects in an Active
Directory depends on what default permissions Active Directory has
been configured with during installation. The two possible permission
options are: Installation
with "Permissions Compatible with Pre-Windows 2000 Servers" This permission option allows any authenticated user
read access to all attributes, including POSIX attributes. This
means, that any user can be configured as a proxy user. For security
reasons, this may not be your best choice. Installation with "Windows
2000 Compatible Access" This option allows authenticated users read rights
to all properties of their own objects, but limited access to attributes
of other objects. Because a proxy user must be able to read all
users' and groups' POSIX attributes, the administrator should specifically
extend the access capabilities for proxy users using one of the
following alternatives: Configure the
proxy user to be a member of "Pre-Windows 2000 Compatible
Access" group. By doing this, you allow the proxy user to read all
properties of user and group objects. Here is how to configure it: Start
Active Directory Users and Computers, From the domain tree, click
Builtin. Double-click Pre-Windows 2000 Compatible Access,
and select the Members tab. Click Add,
from a list of all users and groups, select the user name which
you want to configure as a proxy user, then click Add. Click OK to
save the configuration.
Delegate POSIX attribute
read access to the proxy user. By doing this, you allow the proxy
user to read only POSIX attributes of user and group objects: Start
Active Directory Users and Computers. Click the container which
contains the proxy user, usually it is “Users”. Select Delegate Control from the Action menu. The Delegation
of Control Wizard starts, click Next. On the following screen,
click Add to get a list of
users groups, Choose the proxy user, and click Add and
OK. Back to the screen to select
users and groups, Click Next. You are given the screen
to identify the scope of the task you want to delegate, select
Only the following objects in folder,
check Group objects, click
Next. For SFU, version 2.0: you are given a screen to select permissions. Select Property-specific and the following
permissions: then click Next For SFU, version 3.0: You are prompted to select permissions. Select Property-specific and the following
permissions: then click Next You are given the screen which confirms your configuration, click
on "finish" if everything is correct, otherwise, click "Back" to
change. Repeat above steps to delegate user posix attributes
to the proxy user by choosing "User objects" in 7), and choose the following
posix user attributes in 8): For SFU, version 2.0: For SFU, version 3.0: Read msSFU30HomeDirectory
If you will be using ADS
multiple domains: If you configure LDAP-UX with ADS multiple domains, you configure a
proxy user as described above in one of any domains, then configure
the same proxy user in every domain which you want to include in
your remote domain support with LDAP-UX. For example, first configure
a proxy user proxyusr for the domain ldap.hp.com. Next, include the domain eng.hp.com in the support, and add proxyusr@ldap.hp.com to the domain eng.hp.com using above steps. Repeat these steps for every domain
you want to include. If you have multiple LDAP-UX clients, you can
also configure one proxy user for each client as long as the proxy
user has the access right to all domains that the client wants to
access. The proxy user needs to have access right to read passwd and
group information in multiple domains.
Step 4:
Add an HP-UX Client Machine Account to Active Directory | |
Use the Active Directory Users and Computer tool to create
a user account for your HP-UX host. If you are
using ADS multiple domains: add a host account for HP-UX client
machine to every domain you want to access.
Step 6:
Add POSIX Attributes into the Global Catalog | |
The GCS is the domain controller which hosts the global catalog
for a forest. The global catalog contains partial information of
each domain in the forest. If you want LDAP-UX Client Services to
query GCS to decide which domain a queried data belongs to, then
add the following POSIX attributes into the global catalog: For SFU version 2.0 For SFU version 3.0 For detailed information on how to perform this task, refer
to “Adding
POSIX Attributes to the Global Catalog”. For information on how LDAP-UX Client Services retrieves data
from remote domains, refer to Chapter 3 “Active
Directory Multiple Domains”. |
Printable version
