AIX and Linux Interoperability - IBM Redbooks

shadowExpire $ shadowFlag $ description ) )
( nisSchema.2.2 NAME 'posixGroup' SUP top STRUCTURAL
DESC 'Abstraction of a group of accounts'
MUST ( cn $ gidNumber )
MAY ( userPassword $ memberUid $ description ) )
Example 2-2 User LDIF entry
dn: uid=joe,ou=People,dc=weeorg,dc=com
uid: joe
cn: Joe R. User
objectClass: posixAccount
objectClass: shadowAccount
objectClass: top
userPassword: {crypt}h/WA58b9dz5nI
loginShell: /bin/ksh
uidNumber: 1000
gidNumber: 100
homeDirectory: /home/users/joe
gecos: Joe R. User
shadowLastChange: 11627
shadowMax: 99999
shadowWarning: 7
2.2 Planning for LDAP authentication
We suppose that everybody is already used to vendors implementing services in
their own way even though the service itself may be described by a standard
endorsed by everybody in the industry. It is important to check out all the options
available and see how they relate to each other. Deploying LDAP is not an
exception. Therefore, we examine many solutions for LDAP authentication on
both AIX and Linux.
We need an LDAP server to offer access to the identification and authentication
data and to keep it in good shape. We also need an LDAP client that will be
sufficiently integrated into the operating system to be able to take over the
identification and authentication tasks. We need a thing or two more, such as
implementing the security policy and encrypting the communication (we discuss
these matters later in this chapter).
AIX 5L Version 5.2 is delivered with both an LDAP server (IBM Directory Server)
and an LDAP client. Of course, coming from the same vendor, these two
cooperate nicely. If you are running an AIX-only shop and you plan to stick to it,
this is probably the optimal solution. With the recently included support for PAM,
Chapter 2. Centralized user management 19