I just reconfigured the openldap server and made sure nis and rfc2307bis are loaded. I created a test user with objectClass: aixAuxAccount objectClass: posixAccount objectClass: shadowAccount objectClass: inetOrgPerson I can login to my test linux server with this user but not on the AIX server. When I do a telnet to the AIX server, I can enter the username, but before I can enter the password, I get the error 3004-007 You entered an invalid login name or password. For the password, this is stored in plain text when I add the user. Before I can login to the linux server, I have to change it with passwd and after that, the password is encrypted with {crypt} and I can login to the linux client: userPassword: {crypt}$1$.xxxxxxxxxxxxxxxxxxxxxxxx/ Can this be the problem? I don't know what encrytion AIX expects. Stef ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

Hi, on AIX you don't need to retrieve the password from the ldap server. You can configure AIX to ask the authentication process to the ldap server. In the secldapclntd configuration file (/etc/security/ldap/ldap.cfg) you have to configure these directives (lines took from my deployment): # Authentication type. Valid values are unix_auth and ldap_auth. # Default is unix_auth. # unix_auth - Retrieve user password and authenticate user locally. # ldap_auth - Bind to LDAP server to authenticate user remotely through LDAP. authtype:ldap_auth # AIX-LDAP attribute map path. userattrmappath:/etc/security/ldap/2307user.map groupattrmappath:/etc/security/ldap/2307group.map #idattrmappath:/etc/security/ldap/aixid.map # LDAP class definitions. userclasses:posixaccount,shadowaccount #userclasses:aixaccount,ibm-securityidentities #groupclasses:aixaccessgroup # Search mode. Valid values are ALL and OS. # Default is ALL. # ALL - Returns all attributes of an entry. # OS - Returns only the OS required attributes of an entry. # Non-OS attributes like telephone number, binary images, etc. # will not be returned. # # Note: Use OS only when user entry has many non-OS required attributes # or attributes with large value, e.g. binary data, to reduce # sorting effort by the LDAP server. searchmode:OS # Default user attribute entry location. Valid values are LDAP and local. # The default is LDAP. # LDAP - Use the default entry in LDAP. # local - Use the default entry from /etc/security/user. defaultentrylocation:local You also have to assure yourself that in the file /etc/security/user you have set these properties in association with your users located only local to the system: SYSTEM = "files" registry = files Hope this helps Marco On Wed, Oct 27, 2010 at 10:37 AM, Stef Coene <stef.coene(a)docum.org&gt; wrote: -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

On Wednesday 27 October 2010, Dieter Kluenter wrote: I created a rfc2307bis.ldif from the rfc2307bis.schema file. If I load the rfc2307bis.ldif without nis.ldif, I get an error: additional info: olcObjectClasses: AttributeType not found: "gecos" So I think rfc2305bis dependes on nis... Stef ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

Hi, I finally had some time and I was able to solve my login problems on AIX. I tried the same procedure on a clean AIX installation and I was able to logon using my ldap server . Thx eveybody for the response. Special thx to Marco Pizzoli for the (off-topic) help. Stef ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

On Monday 08 November 2010, you wrote: I'm documenting the steps I do to get it working and the possible problems. When I'm done, I will post them somewhere. I also have to this on the production servers. I still have some problems with the passwords. I have to change the password from an AIX box before it works. Stef ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

Hi, I add the user with ldapscripts on my ubuntu server. First line is from AIX (command "lsldap -a passwd <user>"). Second line is from ldap server (command "ldapmodifyuser <user>") paswoord entry with ldapadduser: userPassword: {SSHA}n9+bpMYtHKOdKislrMXJQsI58JD/Dla3 userPassword:: e1NTSEF9bjkrYnBNWXRIS09kS2lzbHJNWEpRc0k1OEpEL0RsYTM= -> works not for linux and aix client password changed on AIX: userPassword: {crypt}9/Sm0z8ESZNY. userPassword:: e2NyeXB0fTkvU20wejhFU1pOWS4= -> works for AIX and linux client password changed on ubuntu client: userPassword: {crypt}$1$orSXgBl0$6QDpVJNmJbTQy9KaM0LhT0 userPassword:: e2NyeXB0fSQxJG9yU1hnQmwwJDZRRHBWSk5tSmJUUXk5S2FNMExoVDA= -> works for linux, not for aix So, for AIX, only the 'short' crypt works. For linux, any crypt password works. For now, I only need authentication on AIX. Stef ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

Hi, I attached the output from running slapd with -d 255 when doing ldapsearch from the AIX client. Stef ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

On Monday 15 November 2010, Benjamin Griese wrote: I have read the redbook. What ldap server are you running? I'm using ubuntu server 10.04. I think my problem is that I can not bind to the ldap server as a regular user with the ldapsearch command. I can only bind as the admin specfied as olcRootDN with password olcRootPW. I attached the 2 ldif files I use to configure the ldap server. I hope that someone can find en error in it .... I also noted that the userPassword entry for cn=admin,dc=axi,dc=intra is not encrypted. How can I generate an encrypted password? Can this be a {SHA} or has it to be a {SSHA}? Stef ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________