研究室のSolarisサーバ設定覚書part 3

の続きになります。LDAP関係の設定をします。多くがDSCCにログインしての作業です。
Solarisクライアントでは、ユーザ、グループ、オートマウント、ホスト情報をLDAPで管理することにします。

新規サーバの作成

次の設定でサーバを作成します。後にSolarisをクライアントにするのですが、SolarisのLDAPクライアントの制限からLDAPセキュアポートは636でないといけません*1。

項目	設定値
ホスト	ldap.example.com
LDAPポート	389
LDAPセキュアポート	636
インスタンスのパス	/var/opt/SUNWdsee/dsinsX
Directory Manager DN	cn=Directory Manager

パスワードなどは適当に設定します。

SSLの証明書の設定

ディレクトリサーバ->ldap:389->セキュリティ->証明書->その他の証明書の操作->インポートと選択して、前に作ったldap.p12ファイルをインポートします。
インポートが終了したら、サーバを再起動してください。再起動後、ディレクトリサーバ->ldap:389->セキュリティで、証明書を利用予定のものに変更、保存をクリック、サーバ再起動してください。

新規サフィックスの設定

ディレクトリサーバ->ldap:389->サフィックス->新規サフィックスと選択して、サフィックスを作成します。

項目	設定値
dn	dc=example,dc=com
レプリケート	しない
サーバ選択	そのまま
設定	デフォルト
場所	デフォルト
データオプション	サフィックスをそのまま初期化しないでおく

新規スキーマのインストール

Solaris 10のネームサービスをLDAPに対応させるには、RFC 2307bis対応が必要です。しかしながら、このRFCはもともとdraftであり、かなり昔にexpireされています。
DSEE 6.1にはRFC 2307bisは登録されていません。また、RFC 4876も必要です。そこで、この2つのschemaを登録する必要があります。
(なお、/usr/lib/ldap/idsconfigスクリプトは、このschema登録も自動で行っています。)

# ldapmodify -c -D "cn=Directory Manager" -f rfc2307bis.ldif -h ldap.example.com
# ldapmodify -c -D "cn=Directory Manager" -f rfc4876.ldif -h ldap.example.com

rfc2307bis.ldifの内容は、以下の通りです。どうやらschemaが足りないようで、登録できないattributeTypesなどがありますが、-cにより先に進めます。
特に問題なく動きます。

# Full rfc2307 Draft Schema
# 7/17/2007 Added Edirectory Containment rules for automount to be contained within automountMap
# 7/17/2007 Added cn to (may) automount for greater flexibility with autofs
#
version: 1

dn: cn=schema
changetype: modify
add: attributetypes
attributeTypes: ( 1.3.6.1.1.1.1.0 NAME 'uidNumber'
        DESC 'An integer uniquely identifying a user in an administrative domain'
        EQUALITY integerMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
        SINGLE-VALUE
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.1 NAME 'gidNumber'
        DESC 'An integer uniquely identifying a group in an administrative domain'
        EQUALITY integerMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
        SINGLE-VALUE
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.2 NAME 'gecos'
        DESC 'The GECOS field; the common name'
        EQUALITY caseIgnoreIA5Match  SUBSTRINGS caseIgnoreIA5SubstringsMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.3 NAME 'homeDirectory'
        DESC 'The absolute path to the home directory'
        EQUALITY caseExactIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.4 NAME 'loginShell'
        DESC 'The path to the login shell'
        EQUALITY caseExactIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.5 NAME 'shadowLastChange'
        EQUALITY integerMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
        SINGLE-VALUE
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.6 NAME 'shadowMin'
        EQUALITY integerMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
        SINGLE-VALUE
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.7 NAME 'shadowMax'
        EQUALITY integerMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
        SINGLE-VALUE
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.8 NAME 'shadowWarning'
        EQUALITY integerMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
        SINGLE-VALUE
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.9 NAME 'shadowInactive'
        EQUALITY integerMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
        SINGLE-VALUE
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.10 NAME 'shadowExpire'
        EQUALITY integerMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
        SINGLE-VALUE
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.11 NAME 'shadowFlag'
        EQUALITY integerMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
        SINGLE-VALUE
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.12 NAME 'memberUid'
        EQUALITY caseExactIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributeTypes: ( 1.3.6.1.1.1.1.13 NAME 'memberNisNetgroup'
        EQUALITY caseExactIA5Match SUBSTRINGS caseExactIA5SubstringsMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple'
        DESC 'Netgroup triple'
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.15 NAME 'ipServicePort'
        DESC 'Service port number'
        EQUALITY integerMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
        SINGLE-VALUE
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.12 NAME 'memberUid'
        EQUALITY caseExactIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributeTypes: ( 1.3.6.1.1.1.1.13 NAME 'memberNisNetgroup'
        EQUALITY caseExactIA5Match SUBSTRINGS caseExactIA5SubstringsMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple'
        DESC 'Netgroup triple'
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.15 NAME 'ipServicePort'
        DESC 'Service port number'
        EQUALITY integerMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
        SINGLE-VALUE
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.16 NAME 'ipServiceProtocol'
        DESC 'Service protocol name' SUP name
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.17 NAME 'ipProtocolNumber'
        DESC 'IP protocol number'
        EQUALITY integerMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
        SINGLE-VALUE
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.18 NAME 'oncRpcNumber' DESC 'ONC RPC number'
        EQUALITY integerMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
        SINGLE-VALUE
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.19 NAME 'ipHostNumber'
        DESC 'IPv4 addresses as a dotted decimal omitting leading zeros or IPv6  addresses as defined in RFC2373' SUP name
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.20 NAME 'ipNetworkNumber'
        DESC 'IP network as a dotted decimal, eg. 192.168, omitting leading zeros'  SUP name
        SINGLE-VALUE
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.21 NAME 'ipNetmaskNumber'
        DESC 'IP netmask as a dotted decimal, eg. 255.255.255.0, omitting leading  zeros'
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.2
        SINGLE-VALUE
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.22 NAME 'macAddress'
        DESC 'MAC address in maximal, colon separated hex notation, eg.  00:00:92:90:ee:e2'
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.23 NAME 'bootParameter'
        DESC 'rpc.bootparamd parameter'
        EQUALITY caseExactIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.24 NAME 'bootFile' DESC 'Boot image name'
        EQUALITY caseExactIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.26 NAME 'nisMapName'
        DESC 'Name of a A generic NIS map' SUP name
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.27 NAME 'nisMapEntry'
        DESC 'A generic NIS entry'
        EQUALITY caseExactIA5Match  SUBSTRINGS caseExactIA5SubstringsMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.28 NAME 'nisPublicKey' DESC 'NIS public key'
        EQUALITY octetStringMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
        SINGLE-VALUE
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.29 NAME 'nisSecretKey' DESC 'NIS secret key'
        EQUALITY octetStringMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
        SINGLE-VALUE
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.30 NAME 'nisDomain' DESC 'NIS domain'
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.31 NAME 'automountMapName'
        DESC 'automount Map Name'
        EQUALITY caseExactIA5Match  SUBSTR caseExactIA5SubstringsMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.32 NAME 'automountKey'
        DESC 'Automount Key value'
        EQUALITY caseExactIA5Match  SUBSTR caseExactIA5SubstringsMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
        X-ORIGIN 'draft-howard-rfc2307bis' )
attributetypes: ( 1.3.6.1.1.1.1.33 NAME 'automountInformation'
        DESC 'Automount information'
        EQUALITY caseExactIA5Match  SUBSTR caseExactIA5SubstringsMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
        SINGLE-VALUE
        X-ORIGIN 'draft-howard-rfc2307bis' )

dn: cn=schema
changetype: modify
add: objectClasses
objectClasses: ( 1.3.6.1.1.1.2.0 NAME 'posixAccount' SUP top AUXILIARY
        DESC 'Abstraction of an account with POSIX attributes'
        MUST ( cn $ uid $ uidNumber $ gidNumber $ homeDirectory )
        MAY ( authPassword $ userPassword $ loginShell $ gecos $ description )
        X-ORIGIN 'draft-howard-rfc2307bis' )
objectClasses: ( 1.3.6.1.1.1.2.1 NAME 'shadowAccount' SUP top AUXILIARY
        DESC 'Additional attributes for shadow passwords'
        MUST uid
        MAY ( authPassword $ userPassword $ description $ shadowLastChange $  shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $  shadowFlag )
        X-ORIGIN 'draft-howard-rfc2307bis' )
objectClasses: ( 1.3.6.1.1.1.2.2 NAME 'posixGroup' SUP top AUXILIARY
        DESC 'Abstraction of a group of accounts'
        MUST gidNumber
        MAY ( authPassword $ userPassword $ memberUid $ description )
        X-ORIGIN 'draft-howard-rfc2307bis' )
objectClasses: ( 1.3.6.1.1.1.2.3 NAME 'ipService' SUP top STRUCTURAL
        DESC 'Abstraction an Internet Protocol service.
              Maps an IP port and protocol  (such as tcp or udp) to one or more names;
              the distinguished value of the cn  attribute denotes the canonical name of the service'
        MUST ( cn $ ipServicePort $ ipServiceProtocol )
        MAY description
        X-ORIGIN 'draft-howard-rfc2307bis' )
objectClasses: ( 1.3.6.1.1.1.2.4 NAME 'ipProtocol' SUP top STRUCTURAL
        DESC 'Abstraction of an IP protocol.
              Maps a protocol number to one or more  names.
              The distinguished value of the cn attribute denotes the canonical name  of the protocol'
        MUST ( cn $ ipProtocolNumber )
        MAY description
        X-ORIGIN 'draft-howard-rfc2307bis' )
objectClasses: ( 1.3.6.1.1.1.2.5 NAME 'oncRpc' SUP top STRUCTURAL
        DESC 'Abstraction of an Open Network Computing (ONC) [RFC1057] Remote  Procedure Call (RPC) binding.
              This class maps an ONC RPC number to a name.
              The distinguished value of the cn attribute denotes the canonical name of the  RPC service'
        MUST ( cn $ oncRpcNumber )
        MAY description
        X-ORIGIN 'draft-howard-rfc2307bis' )
objectClasses: ( 1.3.6.1.1.1.2.6 NAME 'ipHost' SUP top AUXILIARY
        DESC 'Abstraction of a host, an IP device.
              The distinguished value of the cn  attribute denotes the canonical name of the host.
              Device SHOULD be used as a  structural class'
        MUST ( cn $ ipHostNumber )
        MAY ( authPassword $ userPassword $ l $ description $ manager )
        X-ORIGIN 'draft-howard-rfc2307bis' )
objectClasses: ( 1.3.6.1.1.1.2.7 NAME 'ipNetwork' SUP top STRUCTURAL
        DESC 'Abstraction of a network.
              The distinguished value of the cn attribute  denotes the canonical name of the network.'
        MUST ipNetworkNumber
        MAY ( cn $ ipNetmaskNumber $ l $ description $ manager )
        X-ORIGIN 'draft-howard-rfc2307bis' )
objectClasses: ( 1.3.6.1.1.1.2.8 NAME 'nisNetgroup' SUP top STRUCTURAL
        DESC 'Abstraction of a netgroup. May refer to other netgroups'
        MUST cn
        MAY ( nisNetgroupTriple $ memberNisNetgroup $ description )
        X-ORIGIN 'draft-howard-rfc2307bis' )
objectClasses: ( 1.3.6.1.1.1.2.9 NAME 'nisMap' SUP top STRUCTURAL
        DESC 'A generic abstraction of a NIS map'
        MUST nisMapName
        MAY description
        X-ORIGIN 'draft-howard-rfc2307bis' )
objectClasses: ( 1.3.6.1.1.1.2.10 NAME 'nisObject' SUP top STRUCTURAL
        DESC 'An entry in a NIS map'
        MUST ( cn $ nisMapEntry $ nisMapName )
        MAY description
        X-ORIGIN 'draft-howard-rfc2307bis' )
objectClasses: ( 1.3.6.1.1.1.2.11 NAME 'ieee802Device' SUP top AUXILIARY
        DESC 'A device with a MAC address; device SHOULD be used as a structural  class'
        MAY macAddress
        X-ORIGIN 'draft-howard-rfc2307bis' )
objectClasses: ( 1.3.6.1.1.1.2.12 NAME 'bootableDevice' SUP top AUXILIARY
        DESC 'A device with boot parameters; device SHOULD be used as a structural  class'
        MAY ( bootFile $ bootParameter )
        X-ORIGIN 'draft-howard-rfc2307bis' )
objectClasses: ( 1.3.6.1.1.1.2.14 NAME 'nisKeyObject' SUP top AUXILIARY
        DESC 'An object with a public and secret key'
        MUST ( cn $ nisPublicKey $ nisSecretKey )
        MAY ( uidNumber $ description )
        X-ORIGIN 'draft-howard-rfc2307bis' )
objectClasses: ( 1.3.6.1.1.1.2.15 NAME 'nisDomainObject' SUP top AUXILIARY
        DESC 'Associates a NIS domain with a naming context'
        MUST nisDomain
        X-ORIGIN 'draft-howard-rfc2307bis' )
objectClasses: ( 1.3.6.1.1.1.2.16 NAME 'automountMap' SUP top STRUCTURAL
        MUST ( automountMapName )
        MAY description
        X-ORIGIN 'draft-howard-rfc2307bis' )
objectClasses: ( 1.3.6.1.1.1.2.17 NAME 'automount' SUP top STRUCTURAL
        DESC 'Automount information'
        MUST ( automountKey $ automountInformation )
        MAY ( description $ cn )
        X-ORIGIN 'draft-howard-rfc2307bis'
        X-NDS_CONTAINMENT ('organization' 'organizationalUnit' 'domain' 'locality' 'automountMap') )

# End of LDIF File

rfc4876.ldifファイルの中身も、以下の通りです。ldifファイル中のコメントのように、RFCのテキストを、ldifファイルとしてまとめなおしたものです。

# objectIdentifier      DUAConfSchemaOID        1.3.6.1.4.1.11.1.3.1
# Updated to match RFC 4876 2007-2007
# http://www.rfc-editor.org/rfc/rfc4876.txt
version: 1

dn: cn=schema
changetype: modify
add: attributetypes
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.0 NAME 'defaultServerList'
     DESC 'List of default servers'
     EQUALITY caseIgnoreMatch
     SUBSTR caseIgnoreSubstringsMatch
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
     SINGLE-VALUE )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.1 NAME 'defaultSearchBase'
     DESC 'Default base for searches'
     EQUALITY distinguishedNameMatch
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
     SINGLE-VALUE )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.2 NAME 'preferredServerList'
     DESC 'List of preferred servers'
     EQUALITY caseIgnoreMatch
     SUBSTR caseIgnoreSubstringsMatch
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
     SINGLE-VALUE )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.3 NAME 'searchTimeLimit'
     DESC 'Maximum time an agent or service allows for a
     search to complete'
     EQUALITY integerMatch
     ORDERING integerOrderingMatch
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
     SINGLE-VALUE )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.4 NAME 'bindTimeLimit'
     DESC 'Maximum time an agent or service allows for a
     bind operation to complete'
     EQUALITY integerMatch
     ORDERING integerOrderingMatch
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
     SINGLE-VALUE )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.5 NAME 'followReferrals'
     DESC 'An agent or service does or should follow referrals'
     EQUALITY booleanMatch
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
     SINGLE-VALUE )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.6 NAME 'authenticationMethod'
     DESC 'Identifies the types of authentication methods either
     used, required, or provided by a service or peer'
     EQUALITY caseIgnoreMatch
     SUBSTR caseIgnoreSubstringsMatch
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
     SINGLE-VALUE )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.7 NAME 'profileTTL'
     DESC 'Time to live, in seconds, before a profile is
     considered stale'
     EQUALITY integerMatch
     ORDERING integerOrderingMatch
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
     SINGLE-VALUE )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.9 NAME 'attributeMap'
     DESC 'Attribute mappings used, required, or supported by an
     agent or service'
     EQUALITY caseIgnoreIA5Match
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.10 NAME 'credentialLevel'
     DESC 'Identifies type of credentials either used, required,
     or supported by an agent or service'
     EQUALITY caseIgnoreIA5Match
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
     SINGLE-VALUE )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.11 NAME 'objectclassMap'
     DESC 'Object class mappings used, required, or supported by
     an agent or service'
     EQUALITY caseIgnoreIA5Match
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.12 NAME 'defaultSearchScope'
     DESC 'Default scope used when performing a search'
     EQUALITY caseIgnoreIA5Match
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
     SINGLE-VALUE )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.13 NAME 'serviceCredentialLevel'
     DESC 'Specifies the type of credentials either used, required,
     or supported by a specific service'
     EQUALITY caseIgnoreIA5Match
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.14 NAME 'serviceSearchDescriptor'
     DESC 'Specifies search descriptors required, used, or
     supported by a particular service or agent'
     EQUALITY caseExactMatch
     SUBSTR caseExactSubstringsMatch
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.15 NAME 'serviceAuthenticationMethod'
     DESC 'Specifies types authentication methods either
     used, required, or supported by a particular service'
     EQUALITY caseIgnoreMatch
     SUBSTR caseIgnoreSubstringsMatch
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.16 NAME 'dereferenceAliases'
     DESC 'Specifies if a service or agent either requires,
     supports, or uses dereferencing of aliases.'
     EQUALITY booleanMatch
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
     SINGLE-VALUE )

dn: cn=schema
changetype: modify
objectClasses: ( 1.3.6.1.4.1.11.1.3.1.2.5 NAME 'DUAConfigProfile'
     SUP top STRUCTURAL
     DESC 'Abstraction of a base configuration for a DUA'
     MUST ( cn )
     MAY ( defaultServerList $ preferredServerList $
           defaultSearchBase $ defaultSearchScope $
           searchTimeLimit $ bindTimeLimit $
           credentialLevel $ authenticationMethod $
           followReferrals $ dereferenceAliases $
           serviceSearchDescriptor $ serviceCredentialLevel $
           serviceAuthenticationMethod $ objectclassMap $
           attributeMap $ profileTTL ) )

# end of file for http://www.rfc-editor.org/rfc/rfc4876.txt schema

LDAP ディレクトリ構造の作成

次に、LDAPのディレクトリ構造を作成します。proxyagentに必要なACIもここで設定します。

# ldapmodify -a -c -D "cn=Directory Manager" -f directorysetup.ldif -h ldap.example.com

directorysetup.ldifの中身は、次のようなものを用います。注意点としては、aciの書式は間違っておらず、DSEEはこれできちんと動作するのですが、あとでDSCC上から設定変更をしようとすると、改行が含まれているせいで、再登録できません。その際は、DSEEのエディタで、aciが1行になるようにしてください。

ersion: 1

dn: dc=example,dc=com
aci: (target = "ldap:///dc=example,dc=com")
 (targetscope = subtree)
 (targetattr = "cn||uid||uidNumber||gidNumber||homeDirectory||shadowLastChange||shadowMin||shadowMax||shadowWarning||shadowInactive||shadowExpire||shadowFlag||memberUid")
 (version 3.0;
  acl "Deny Write access from Self for Naming Services";
  deny (write)
       (userdn = "ldap:///self");)
aci: (target = "ldap:///dc=example,dc=com")
 (targetscope = subtree)
 (targetattr != "userPassword")
 (version 3.0;
  acl "Allow Read,Search,Compare access from Anyone";
  allow (read, search, compare)
        (userdn = "ldap:///anyone");)
aci: (target = "ldap:///dc=example,dc=com")
 (targetscope = subtree)
 (targetattr = "*")
 (version 3.0;
  acl "Allow Write access from Proxyagents";
  allow (write)
        (userdn = "ldap:///cn=proxyagent,ou=Profile,dc=example,dc=com");)
objectClass: top
objectClass: domain
objectclass: nisDomainObject
dc: example
nisdomain: example.com

dn: ou=People,dc=example,dc=com
objectClass: top
objectClass: organizationalUnit
ou: People

dn: ou=Groups,dc=example,dc=com
objectClass: top
objectClass: organizationalUnit
ou: Groups

dn: ou=Hosts,dc=example,dc=com
objectclass: top
objectclass: organizationalUnit
ou: Hosts

dn: ou=Profile,dc=example,dc=com
objectclass: top
objectclass: organizationalUnit
ou: Profile

dn: automountMapName=auto_master,dc=example,dc=com
objectclass: top
objectclass: automountMap
automountmapname: auto_master

dn: automountKey=/home,automountMapName=auto_master,dc=example,dc=com
objectclass: top
objectclass: automount
automountinformation: auto_home -nobrowse
automountkey: /home

dn: automountMapName=auto_home,dc=example,dc=com
objectclass: top
objectclass: automountMap
automountmapname: auto_home

dn: cn=proxyagent,ou=Profile,dc=example,dc=com
objectClass: top
objectClass: person
sn: proxyagent
cn: proxyagent
userPassword: {crypt}dWdK5RanhBZYM

dn: cn=default,ou=Profile,dc=example,dc=com
objectclass: top
objectclass: DUAConfigProfile
authenticationmethod: tls:simple
bindtimelimit: 10
cn: ogatalab
credentiallevel: proxy
defaultsearchbase: dc=example,dc=com
defaultsearchscope: one
defaultserverlist: 192.168.0.1
followreferrals: TRUE
profilettl: 43200
searchtimelimit: 30
servicesearchdescriptor: group:ou=Groups,dc=example,dc=com?one
servicesearchdescriptor: passwd:ou=People,dc=example,dc=com?one
serviceSearchDescriptor: shadow:ou=People,dc=example,dc=com?one

*1:See Native Solaris LDAP client over SSL

新規サーバの作成

SSLの証明書の設定

新規サフィックスの設定

新規スキーマのインストール

LDAPディレクトリ構造の作成

LDAP ディレクトリ構造の作成