 |
» |
|
|
|
This section describes the requirements and steps on how to prepare Active Directory to work with LDAP-UX Client Services. | | | |  | NOTE: If you will be configuring your system for ADS multiple domains, there will be some additional configuration instructions to follow. These are listed under the appropriate step number. | | | | |
Step 1: Install Active Directory | |
Even though Active Directory is an integral component of the Windows 2000 operating system, it must be installed separately after the Windows 2000 Server installation has been completed on your computer. After the final reboot of the Windows 2000 installation: The Windows 2000 Configure Your Server screen is displayed, select Active Directory (in the left column). Click Start to initiate the Active Directory Installation Wizard. | | | | | NOTE: You can also initiate the Active Directory Installation Wizard at any future time, by clicking on Start, Programs, Administrative Tools, Configure Your Server. Choose Active Directory and click on Start. | | | | |
Install any additional Administrative tools required for you to manage Active Directory. These Windows 2000 Administrative tools are included with Windows 2000 Server to simplify directory administration, but they must be installed separately if your system is running Windows 2000 Professional. The following tools may be required: Make sure you have Active Directory Users and Computers which is needed to manage user accounts. The Active Directory Schema snap-in allows you to manage your Active Directory schema. For installation information, refer to the Active Directory on-line Help "Manage the schema". Active Directory Services interface (ADSI) editor is part of Windows 2000 Support Tools and is used to create and modify Active Directory objects. The Windows 2000 Support Tools can be found on the Windows 2000 Server CD. Click on support/tools/setup to start the setup wizard.
If ADS multiple domains will be used, set up the ADS forest. Ideally, the local domain should contain the most frequently accessed data.
The Active Directory must be installed separately after the Windows 2003 Server installation has been completed on your computer. Use the following steps to install the Acitve Directory Server on the Windows 2003: The Prelimary Steps screen is displayed, select Configure Your Server Wizard. The Server Role screen is displayed, select Domain Controller (Active Directory), then click Next buttom. Install any additional Administrative tools required for you to manage Active Directory. These Windows 2003 Administrative tools are included with Windows 2003 Server to simplify directory administration. If ADS multiple domains will be used, set up the ADS forest. Ideally, the local domain should contain the most frequently accessed data.
Step 2: Install SFU 2.0, 3.0 or 3.5 including Server for NIS | |
POSIX accounts have some attributes, such as user ID, login shell, and home directory, which are not used by Windows 2000 or 2003. To use Active Directory as a data repository for HP-UX users, the Active Directory schema needs to be extended to include the POSIX schema defined in RFC 2307. Server for NIS, a tool available with the Services for Unix (SFU) add-on package, extends the Active Directory schema based on RFC 2307 to allow integration of POSIX attributes. For corresponding Windows objects that exist in Active Directory (such as password and group), Server for NIS adds POSIX attributes to the same object creating a unique object representing both POSIX and Windows identities. For example, information needed for a UNIX user is stored in Active Directory as part of the Active Directory Domain Users group. To allow storing POSIX attributes, Server for NIS extends the Users group with msSFUPosixAccount as its auxiliary class (SFU version 2.0). This allows POSIX attributes to be added to newly created objects of the User class. Version of SFU above 2.0 include the version string in these attribute names (i.e. msSFU30IpServic). More information on SFU can be found on the Microsoft web site at http://www.microsoft.com/windows2000/sfu/. | | | | | NOTE: Windows 2003 Release 2 (R2) Active Directory Server provides the RFC2307 schema which is compliant with the IETF RFC2307 standard. | | | | |
Step 3: Create a Proxy User | |
The use of a proxy user is mandatory for Active Directory, as anonymous binding done not grant enough access rights to retrieve user, group, or any other name service data. Use the Windows 2000 management tool, Active Directory Users and Computers, to add a proxy user as a member of the "Domain Users" group. The proxy user is used by the LDAP-UX clients to bind to the ADS for access to the name service data on the ADS. For example, you might add a user: CN=Proxy User, CN=Users, DC=cup, DC=hp, DC=com | | | |  | CAUTION: Make sure the proxy user is a member of the Domain Users group, which allows read access only, and not the Administrator group to protect Active Directory entries from malicious modifications. | | | | |
A proxy user's access right to objects in an Active Directory depends on what default permissions Active Directory has been configured with during installation. The two possible permission options are: Installation with "Permissions Compatible with Pre-Windows 2000 Servers" This permission option allows any authenticated user read access to all attributes, including POSIX attributes. This means, that any user can be configured as a proxy user. For security reasons, this may not be your best choice. Installation with "Windows 2000 Compatible Access" This option allows authenticated users read rights to all properties of their own objects, but limited access to attributes of other objects. Because a proxy user must be able to read all users' and groups' POSIX attributes, the administrator should specifically extend the access capabilities for proxy users using one of the following alternatives: Configure the proxy user to be a member of "Pre-Windows 2000 Compatible Access" group. By doing this, you allow the proxy user to read all properties of user and group objects. Here is how to configure it: Start Active Directory Users and Computers, From the domain tree, click Builtin. Double-click Pre-Windows 2000 Compatible Access, and select the Members tab. Click Add, from a list of all users and groups, select the user name which you want to configure as a proxy user, then click Add. Click OK to save the configuration.
Delegate POSIX attribute read access to the proxy user. By doing this, you allow the proxy user to read only POSIX attributes of user and group objects: Start Active Directory Users and Computers. Click the container which contains the proxy user, usually it is "Users". Select Delegate Control from the Action menu. The Delegation of Control Wizard starts, click Next. On the following screen, click Add to get a list of users groups, Choose the proxy user, and click Add and OK. Back to the screen to select users and groups, Click Next. If you use Windows 2003 R2, you are given the screen to identify the task to delegate, select Create a custom task to delegate, click Next. Otherwise, skip this step. You are given the screen to identify the scope of the task you want to delegate, select Only the following objects in folder, check Group objects, click Next. For SFU, version 2.0: you are given a screen to select permissions. Select Property-specific and the following permissions: then click Next For SFU, version 3.0 or 3.5: You are prompted to select permissions. Select Property-specific and the following permissions: then click Next For R2's RFC2307: You are prompted to select permissions. Select Property-specific and the following permissions: then click Next You are given the screen which confirms your configuration, click on "finish" if everything is correct, otherwise, click "Back" to change. Repeat above steps to delegate user posix attributes to the proxy user by choosing "User objects" in 8), and choose the following posix user attributes in 9): For SFU, version 2.0: For SFU, version 3.0 or 3.5: Read msSFU30HomeDirectory
For R2's RFC2307:
If you will be using ADS multiple domains: If you configure LDAP-UX with ADS multiple domains, you configure a proxy user as described above in one of any domains, then configure the same proxy user in every domain which you want to include in your remote domain support with LDAP-UX. For example, first configure a proxy user proxyusr for the domain ldap.hp.com. Next, include the domain eng.hp.com in the support, and add proxyusr@ldap.hp.com to the domain eng.hp.com using above steps. Repeat these steps for every domain you want to include. If you have multiple LDAP-UX clients, you can also configure one proxy user for each client as long as the proxy user has the access right to all domains that the client wants to access. The proxy user needs to have access right to read passwd and group information in multiple domains.
Step 4: Add an HP-UX Client Machine Account to Active Directory | |
Use the Active Directory Users and Computer tool to create a user account for your HP-UX host. If you are using ADS multiple domains: add a host account for HP-UX client machine to every domain you want to access.
Step 6: Add POSIX Attributes into the Global Catalog | |
The GCS is the domain controller which hosts the global catalog for a forest. The global catalog contains partial information of each domain in the forest. If you want LDAP-UX Client Services to query GCS to decide which domain a queried data belongs to, then add the following POSIX attributes into the global catalog: For SFU version 2.0 For SFU version 3.0 or 3.5 For Windows 2003 R2's RFC2307 For detailed information on how to perform this task, refer to “Adding POSIX Attributes to the Global Catalog”. For information on how LDAP-UX Client Services retrieves data from remote domains, refer to “Active Directory Multiple Domains”. |
Printable version
