<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> On 09/09/2012 04:25 PM, Sigbjorn Lie wrote: <blockquote cite="mid:504CFB57.8030004@nixtra.com" type="cite"> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> <div class="moz-cite-prefix">On 09/07/2012 08:38 PM, Dmitri Pal wrote: </div> <blockquote cite="mid:504A3F0A.4090402@redhat.com" type="cite"> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> On 09/02/2012 12:58 PM, Sigbjorn Lie wrote: <blockquote cite="mid:50439019.8080804@nixtra.com" type="cite"> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> <div class="moz-cite-prefix">On 09/02/2012 04:37 PM, Natxo Asenjo wrote: </div> <blockquote cite="mid:CAHBEJzU64GJLYUwpJxUw7eqC6zc0A7cnGp0j4rUD3E3q3tY-Vg@mail.gmail.com" type="cite">hi, Recently I have been playing with the zfs for its native nfs4 acl capabilities. I have used openindiana for this. For those wondering about openindiana, it is a distribution of the former opensolaris code. I got the ldap client to work for retrieveing user/group info from ipa using the ldapclient command: # ldapclient manual \ -a authenticationMethod=none \ -a defaultSearchBase=dc=ipa,dc=asenjo,dc=nx \ -a domainName=ipa.asenjo.nx \ -a defaultServerList=kdc.ipa.asenjo.nx \ -a serviceSearchDescriptor='passwd:dc=ipa,dc=asenjo,dc=nx?sub' \ -a serviceSearchDescriptor='group:dc=ipa,dc=asenjo,dc=nx?sub' [enter] you need to enable the ldap/client service: # svcadm enable ldap/client:default [enter] After which, modify /etc/nsswitch.conf to add the ldap provider for passwd and group: passwd: files ldap group: files ldap That's it, test it: # id admin uid=642800000(admin) gid=642800000(admins) groups=642800000(admins) # getent passwd admin admin:x:642800000:642800000:Administrator:/home/admin:/bin/bash So it works. The kerberos stuff will be next ... One thing I have not yet gotten to work is that these changes are not persistent accross reboots. The ldapclient config stays, but the service ldap/client does not start (stays disabled) and nsswitch.conf missess the ldap entries. So far I am fixing this from cfengine (gotta love it). So apparently, for solaris 10 and newer versions, the procedure outlined in <a moz-do-not-send="true" href="http://freeipa.com/page/ConfiguringSolarisClients">http://freeipa.com/page/ConfiguringSolarisClients</a> is no longer necessary as far as the ldap client is concerned. -- Groeten, natxo <fieldset class="mimeAttachmentHeader"></fieldset> <pre wrap="">_______________________________________________ Freeipa-users mailing list <a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> <a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre> </blockquote> Hi, I'm using Nexenta as an IPA client, another derivative of OpenSolaris. I use a DUAProfile with ldapclient. This stays configured and the ldap/client service is enabled across reboots. There is a DUAProfile included by default with IPA, but it requires some tweaking to support more than just the basic features. See this bugzilla for a more comprehensive example: <a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://bugzilla.redhat.com/show_bug.cgi?id=815515">https://bugzilla.redhat.com/show_bug.cgi?id=815515</a> There is also some more info about configuring Solaris clients in this bugzilla: <a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://bugzilla.redhat.com/show_bug.cgi?id=815533">https://bugzilla.redhat.com/show_bug.cgi?id=815533</a> </blockquote> Siggi, can you please review <a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://docs.fedoraproject.org/en-US/Fedora/17/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_Solaris.html">http://docs.fedoraproject.org/en-US/Fedora/17/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_Solaris.html</a> and confirm that this is correct and has the latest? If you find some inconsistency would mind filing a fedora doc bug? </blockquote> There are some issues in that document. I have been working with Rob with regards to the previous 2 bugzilla doc bug's I opened: <a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://bugzilla.redhat.com/show_bug.cgi?id=815533">https://bugzilla.redhat.com/show_bug.cgi?id=815533</a> <a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://bugzilla.redhat.com/show_bug.cgi?id=815515">https://bugzilla.redhat.com/show_bug.cgi?id=815515</a> These BZ covers configuring a DUA profile and configuring Solaris 10 as an IPA client. I presume Rob's work will become the new Solaris 10 IPA Client documentation for both Fedora and RHEL? </blockquote> Thanks for update. We might ask you for a final review. The Fedora and RHEL documentation is a bit different in this regard. For Fedora we can easily document the information you provided. For RHEL we need to find some other avenue to deliver the information because Red Hat support organization can't be responsible for proper configuration of the non RHEL operating systems so we can't have it in the Red Hat documentation. But we will figure it out. <blockquote cite="mid:504CFB57.8030004@nixtra.com" type="cite"> Rgds, Siggi <pre wrap=""> <fieldset class="mimeAttachmentHeader"></fieldset> _______________________________________________ Freeipa-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre> </blockquote> <pre class="moz-signature" cols="72">-- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? <a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a> </pre> </body> </html>