<html><body><div style="color:#000; background-color:#fff; font-family:bookman old style, new york, times, serif;font-size:13px"><div id="yui_3_16_0_1_1426103341352_9548"><span></span></div><div id="yui_3_16_0_1_1426103341352_10098">This is how use the automounter to automatically create home directories for ipa users under /export/home/ and mount them under /home/ on Solaris 10, as well as copy over the profile files and assign appropriate owner and group:</div><div id="yui_3_16_0_1_1426103341352_10380"><br></div><div id="yui_3_16_0_1_1426103341352_10404" dir="ltr">We first created a service account called "auth" in ipa to allow ldap lookups with no password expiration<br></div><div id="yui_3_16_0_1_1426103341352_10136"><br></div><div id="yui_3_16_0_1_1426103341352_10154" dir="ltr">On the clients create a "mkhomedir" script in /usr/local/adm (or where ever you like):</div><div id="yui_3_16_0_1_1426103341352_10159" dir="ltr">#!/bin/ksh -p<br style="" class=""><br style="" class="">HOMEDIRPATH=/home<br style="" class=""><br style="" class="">PHYSICALDIRPATH=/export/home<br style="" class=""><br style="" class="">hdir=~$1<br style="" class=""><br style="" class="">phdir="$PHYSICALDIRPATH/$1"<br style="" class=""><br style="" class="">if [ -d "$phdir" ]; then<br style="" class=""> echo "localhost:$phdir"<br style="" class=""> exit<br style="" class="">fi<br style="" class=""><br style="" class="">mkdir -p $phdir<br style="" class=""><br style="" class="">#Perform ldap lookup to get user and group of logged in user <br></div><div id="yui_3_16_0_1_1426103341352_10497" dir="ltr">GID=`ldapsearch -h idmserver.example.com -D "uid=auth,cn=users,cn=accounts,dc=example,d<br style="" class="">c=com" -w 'authpassword' -b "cn=users,cn=accounts,dc=example,dc=com" "(uid=$1)"<br style="" class=""> | grep gid | cut -d " " -f2`<br style="" class=""><br style="" class="">#Copy profile files</div><div id="yui_3_16_0_1_1426103341352_10571" dir="ltr">cp /etc/skel/.bash_profile $phdir/.bash_profile<br style="" class="">cp /etc/skel/.bashrc $phdir/.bashrc<br style="" class="">cp /etc/skel/.profile $phdir/.profile<br style="" class="">cp /etc/skel/.vimrc $phdir/.vimrc<br style="" class=""><br style="" class="">#Change the owner and group to logged in user<br></div><div id="yui_3_16_0_1_1426103341352_10596" dir="ltr">chown -R "$1":"$GID" $phdir<br style="" class=""><br style="" class="">echo "localhost:$phdir"</div><div id="yui_3_16_0_1_1426103341352_10522" dir="ltr"><br></div><div id="yui_3_16_0_1_1426103341352_10523" dir="ltr">######END########</div><div id="yui_3_16_0_1_1426103341352_10650" dir="ltr"><br></div><div id="yui_3_16_0_1_1426103341352_10668" dir="ltr">You need to change permissions on the "mkhomedir" script to 755<br></div><div id="yui_3_16_0_1_1426103341352_10221" dir="ltr"><br></div><br><div id="yui_3_16_0_1_1426103341352_13534" dir="ltr">Login to client directly as root so you can move home directories around (edit /etc/ssh/sshd_config if needed to allow this)<br></div><div id="yui_3_16_0_1_1426103341352_13535" dir="ltr"><br></div><div id="yui_3_16_0_1_1426103341352_13706" dir="ltr">Ensure no one else is logged in<br style="" class=""></div><div id="yui_3_16_0_1_1426103341352_13682" style="" class="">Ensure nothing else is mounted in /export/home</div><div id="yui_3_16_0_1_1426103341352_13607" style="" class=""><span id="yui_3_16_0_1_1426103341352_13641" class="" style="">Copy home directories to /export/home </span><strong id="yui_3_16_0_1_1426103341352_13608" style="" class=""></strong><br></div><div id="yui_3_16_0_1_1426103341352_13710" style="" class="">rsync -av /home/ /export/home/</div><div id="yui_3_16_0_1_1426103341352_13738" style="" class=""><br></div><div style="" class="" id="yui_3_16_0_1_1426103341352_10263" dir="ltr">Add this line to the /etc/auto_master file so the "mkhomedir" script runs at login<br></div><div style="" class="" id="yui_3_16_0_1_1426103341352_10276" dir="ltr">/home /usr/local/adm/mkhomedir</div><div style="" class="" id="yui_3_16_0_1_1426103341352_13524" dir="ltr"><br style="" class=""></div><div id="yui_3_16_0_1_1426103341352_13776" style="" class="" dir="ltr">Remove original /home/ directories<br></div><div id="yui_3_16_0_1_1426103341352_13805" style="" class="" dir="ltr">rm -rf /home/*</div><div id="yui_3_16_0_1_1426103341352_13834" style="" class="" dir="ltr"><br></div><div id="yui_3_16_0_1_1426103341352_13618" style="" class=""><span id="yui_3_16_0_1_1426103341352_13835" class="" style="">Restart autofs</span> so the change takes effect<br></div><div id="yui_3_16_0_1_1426103341352_13832" style="" class="">svcadm restart autofs</div><div id="yui_3_16_0_1_1426103341352_13950" style="" class=""><br></div><div id="yui_3_16_0_1_1426103341352_13968" dir="ltr" style="" class="">Make sure you change your sshd_config back if you don't wish to allow root ssh access.<br></div><div id="yui_3_16_0_1_1426103341352_9552" style="font-family: bookman old style, new york, times, serif; font-size: 13px;"> <div id="yui_3_16_0_1_1426103341352_9551" style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div id="yui_3_16_0_1_1426103341352_9561" class="yiv2405601287WordSection1"> <hr id="yui_3_16_0_1_1426103341352_9571" size="1"><font id="yui_3_16_0_1_1426103341352_9549" face="Arial" size="2"><b id="yui_3_16_0_1_1426103341352_9554"><span id="yui_3_16_0_1_1426103341352_9553" style="font-weight:bold;"></span></b></font><div id="yui_3_16_0_1_1426103341352_9569" class="yiv2405601287MsoNormal"><b id="yui_3_16_0_1_1426103341352_9638"><span id="yui_3_16_0_1_1426103341352_9637" style="font-size:10.0pt;font-family:"Tahoma", "sans-serif";">From:</span></b><span id="yui_3_16_0_1_1426103341352_9568" style="font-size:10.0pt;font-family:"Tahoma", "sans-serif";"> freeipa-users-bounces@redhat.com [mailto:freeipa-users-bounces@redhat.com] <b>On Behalf Of </b>Ben .T.George<br><b id="yui_3_16_0_1_1426103341352_9597">Sent:</b> Wednesday, March 11, 2015 11:22 AM<br><b id="yui_3_16_0_1_1426103341352_9596">To:</b> dpal<br><b>Cc:</b> freeipa-users<br><b id="yui_3_16_0_1_1426103341352_9598">Subject:</b> Re: [Freeipa-users] how can i create home directories automatically on solaris while IPA user login</span></div><div id="yui_3_16_0_1_1426103341352_9567" class="yiv2405601287MsoNormal"> </div><div id="yui_3_16_0_1_1426103341352_9566"><div id="yui_3_16_0_1_1426103341352_9565" class="yiv2405601287MsoNormal">from BZ</div><div id="yui_3_16_0_1_1426103341352_9600"><div id="yui_3_16_0_1_1426103341352_9599" class="yiv2405601287MsoNormal"> </div></div><div id="yui_3_16_0_1_1426103341352_9603"><div id="yui_3_16_0_1_1426103341352_9602" class="yiv2405601287MsoNormal">"<span id="yui_3_16_0_1_1426103341352_9601" style="color:black;">While we value your interest in IPA Solaris support, the implementation of the DUA profile is not on our nearest schedule at the moment. We lack both knowledge and resources to focus on integration with Solaris. This is where we need a help (ideally patches) and contribution from the community to help us push these features in.</span></div></div><pre id="yui_3_16_0_1_1426103341352_9626" style="white-space:pre-wrap;word-wrap:break-word;"><span id="yui_3_16_0_1_1426103341352_9625" style="color:black;">I checked your example DUAConfigProfile and I think it cannot be just added to FreeIPA right away. E.g. for defaultServerList or preferredServerList, you would need to expand installers and ipa-replica-manage to handle these lists and update them when replica is added or updated to prevent it being outdated. printers or aliases serviceSearchDescriptor refers to objects not being available and so on. It is not as straightforward as it seems.</span></pre><pre><span style="color:black;"> </span></pre><pre><span style="color:black;">What I think that we can work on is to work together on</span></pre><pre><span style="color:black;"><a rel="nofollow" target="_blank" href="http://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_Solaris.html#Configuring_an_IPA_Client_on_Solaris_10"><span style="color:#0066CC;">http://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/Configuring_an_IPA_Client_on_Solaris.html#Configuring_an_IPA_Client_on_Solaris_10</span></a></span></pre><pre><span style="color:black;">... and add all the steps needed to make IPA work on Solaris 10. I could for example prepare an updated page and you could review it. Would that work for you?"</span></pre><pre style="white-space:pre-wrap;word-wrap:break-word;"><span style="color:black;"> </span></pre><pre style="white-space:pre-wrap;word-wrap:break-word;"><span style="color:black;">this what i followed util now. but's not authenticate with AD, IPA user can login on solaris box</span></pre><pre style="white-space:pre-wrap;word-wrap:break-word;"><span style="color:black;"> </span></pre><pre style="white-space:pre-wrap;word-wrap:break-word;"><span style="color:black;"> </span></pre></div><div><div class="yiv2405601287MsoNormal"> </div><div><div class="yiv2405601287MsoNormal">On Wed, Mar 11, 2015 at 9:11 PM, Dmitri Pal <<a rel="nofollow" ymailto="mailto:dpal@redhat.com" target="_blank" href="mailto:dpal@redhat.com">dpal@redhat.com</a>> wrote:</div><div><div><div class="yiv2405601287MsoNormal">On 03/11/2015 01:56 PM, Ben .T.George wrote:</div></div><blockquote style="margin-top:5.0pt;margin-bottom:5.0pt;"><div><div class="yiv2405601287MsoNormal">HI </div><div><div class="yiv2405601287MsoNormal"> </div></div><div><div class="yiv2405601287MsoNormal">yea , i saw that mail thread and he claims that he achieved somehow. but not clear.</div></div><div><div class="yiv2405601287MsoNormal"> </div></div><div><div class="yiv2405601287MsoNormal">and the steps mentioned is too technical for me. :) as i am very new to IPA it's bit confusing. </div></div><div><div class="yiv2405601287MsoNormal"> </div></div><div><div class="yiv2405601287MsoNormal">later that thread also closed without proper explanation. </div></div><div><div class="yiv2405601287MsoNormal"> </div></div><div><div class="yiv2405601287MsoNormal">i think you guys can contact him to change existing wiki :) as there are many solaris related documents which is pretty old.</div></div><div><div class="yiv2405601287MsoNormal"> </div></div><div><div class="yiv2405601287MsoNormal">anyway still waiting for rply</div></div></div></blockquote><div class="yiv2405601287MsoNormal"><br>Have you found the BZ? They are very detailed.<br><a rel="nofollow" target="_blank" href="https://bugzilla.redhat.com/show_bug.cgi?id=815515">https://bugzilla.redhat.com/show_bug.cgi?id=815515</a><br>The DUA profile is attached to the bug.</div><div><div><div class="yiv2405601287MsoNormal"><br><br><br></div><div><div><div class="yiv2405601287MsoNormal"> </div></div><div><div class="yiv2405601287MsoNormal">Regards,</div></div><div><div class="yiv2405601287MsoNormal">Ben</div></div></div><div><div class="yiv2405601287MsoNormal"> </div><div><div class="yiv2405601287MsoNormal">On Wed, Mar 11, 2015 at 8:49 PM, Dmitri Pal <<a rel="nofollow" ymailto="mailto:dpal@redhat.com" target="_blank" href="mailto:dpal@redhat.com">dpal@redhat.com</a>> wrote:</div><div><div><div class="yiv2405601287MsoNormal">On 03/11/2015 01:18 PM, Ben .T.George wrote:</div></div><blockquote style="margin-top:5.0pt;margin-bottom:5.0pt;"><div><div class="yiv2405601287MsoNormal">HI </div><div><div class="yiv2405601287MsoNormal"> </div></div><div><div class="yiv2405601287MsoNormal">thanks for the rply.</div></div><div><div class="yiv2405601287MsoNormal"> </div></div><div><div class="yiv2405601287MsoNormal">even i tried native auto_master file with directory checking script. if i feed the user manually to the script, the directory is creating and while login request comes, it didn't.</div></div><div><div class="yiv2405601287MsoNormal"> </div></div><div><div class="yiv2405601287MsoNormal">i don't think no one did full solaris integration util now as i asked many questions related to that.</div></div><div><div class="yiv2405601287MsoNormal"> </div></div><div><div class="yiv2405601287MsoNormal">now i am little bit confident up to this level. and if everything is working fine, i will try to create automated script for IPA join</div></div></div></blockquote><div class="yiv2405601287MsoNormal"><br>I really do not know Solaris that well. There are some threads from this and last week about Solaris. You can find them in the mail archive for March.<br>There are pointers to wikis and bugzillas in those threads. The bugzilla bugs have some extended info on how to configure Solaris clients. They were pretty detailed. May be they have the automount info you are looking for. </div><div><div><div class="yiv2405601287MsoNormal"><br><br><br></div><div><div><div class="yiv2405601287MsoNormal"> </div></div><div><div class="yiv2405601287MsoNormal">Regards,</div></div><div><div class="yiv2405601287MsoNormal">Ben</div></div><div><div class="yiv2405601287MsoNormal"> </div></div><div><div class="yiv2405601287MsoNormal"> </div></div></div><div><div class="yiv2405601287MsoNormal"> </div><div><div class="yiv2405601287MsoNormal">On Wed, Mar 11, 2015 at 7:32 PM, Dmitri Pal <<a rel="nofollow" ymailto="mailto:dpal@redhat.com" target="_blank" href="mailto:dpal@redhat.com">dpal@redhat.com</a>> wrote:</div><div><div><div class="yiv2405601287MsoNormal">On 03/11/2015 09:50 AM, Ben .T.George wrote:</div></div><blockquote style="margin-top:5.0pt;margin-bottom:5.0pt;"><div><div class="yiv2405601287MsoNormal">HI </div><div><div class="yiv2405601287MsoNormal"> </div></div><div><div class="yiv2405601287MsoNormal">i can able to reach upto level that IPA user can able to login on solaris box,</div></div><div><div class="yiv2405601287MsoNormal"> </div></div><div><div class="yiv2405601287MsoNormal">but how can i create home directories automatically on solaris while IPA user login.</div></div><div><div class="yiv2405601287MsoNormal"> </div></div><div><div class="yiv2405601287MsoNormal">even i change the shell in IPA web interface that is getting affected. i saw some option in IPA 3.3 web interface like automount and that is not in IPA 4.1.2 </div></div></div></blockquote><div class="yiv2405601287MsoNormal"><br>All the options are still there. The menus got re-arranged a bit.<br>Hopefully someone with a Solaris knowledge will help you with the rest.<br><br><br></div><div><div><div class="yiv2405601287MsoNormal"> </div></div><div><div class="yiv2405601287MsoNormal">please anyone tell me where it is and how can i achieve this</div></div><div><div class="yiv2405601287MsoNormal"> </div></div><div><div class="yiv2405601287MsoNormal">regards,</div></div><div><div class="yiv2405601287MsoNormal">Ben</div></div></div><div class="yiv2405601287MsoNormal" style="margin-bottom:12.0pt;"> </div><div class="yiv2405601287MsoNormal"><br><br><br><span style="color:#888888;"></span></div><pre><span style="color:#888888;">-- </span></pre><pre><span style="color:#888888;">Thank you,</span></pre><pre><span style="color:#888888;">Dmitri Pal</span></pre><pre><span style="color:#888888;"> </span></pre><pre><span style="color:#888888;">Sr. Engineering Manager IdM portfolio</span></pre><pre><span style="color:#888888;">Red Hat, Inc.</span></pre></div><div class="yiv2405601287MsoNormal"><br>--<br>Manage your subscription for the Freeipa-users mailing list:<br><a rel="nofollow" target="_blank" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>Go to <a rel="nofollow" target="_blank" href="http://freeipa.org/">http://freeipa.org</a> for more info on the project</div></div><div class="yiv2405601287MsoNormal"> </div></div><div class="yiv2405601287MsoNormal"><br><br><br></div><pre>-- </pre><pre>Thank you,</pre><pre>Dmitri Pal</pre><pre> </pre><pre>Sr. Engineering Manager IdM portfolio</pre><pre>Red Hat, Inc.</pre></div></div></div></div><div class="yiv2405601287MsoNormal"> </div></div><div class="yiv2405601287MsoNormal"><br><br><br></div><pre>-- </pre><pre>Thank you,</pre><pre>Dmitri Pal</pre><pre> </pre><pre>Sr. Engineering Manager IdM portfolio</pre><pre>Red Hat, Inc.</pre></div></div></div></div><div class="yiv2405601287MsoNormal"> </div></div></div><div id="yui_3_16_0_1_1426103341352_9559" class="y_msg_container"><br><br></div> </div> </div> </div></body></html>