Integration of IBM Aix and Microsoft Active directory with Kerberos and LDAP

Source: Internet
Author: User
Tags ldap fully qualified domain name

Why is Kerberos and LDAP

LDAP is very effective for storing and retrieving user attributes for AIX users, but using LDAP for authentication still requires the user to provide an AIX password and an AD password. Kerberos supports AIX using the local AD protocol to authenticate users by referencing their Microsoft Windows passwords.

Active Directory Properties for use

The following AD properties can be used by AIX to obtain user information.

Before Start-prerequisites

The following items need to be configured before starting the process.

The Domain Name System (DNS) records (A and PTR) of the AIX hosts in your Windows DNS server.

The computer object in Active Directory that matches the AIX host name.

The organizational unit (OU) that contains the AIX object.

The target OU contains at least one user who supports UNIX.

The ad service account that can be used to bind LDAP to AD. The service account should have full Read permissions on any OU that will have UNIX-enabled users.

Ensure that the hostname command returns the fully qualified domain name (FQDN) of the AIX server. The/etc/hosts entry for the host should be {IP} {FQDN} {short Name}

Make sure that the AIX host will use the DNS domain controller.

Configure Network Time Protocol (NTP) on the AIX server. (Kerberos will fail if the clock exceeds 5 minutes.) )

Configure Syslog or verify that it is running as expected.

Sample Environment

Sample scenarios can be tested using AIX 6.1 TL 6 and TL 8 and AIX 7.1 tl 1, and Active Directory on the Server 2008 R2 domain controllers runs at the 2003 functional level. It is important to emphasize that the domain controller must be a Windows Server 2003 R2 or a later version to contain the out-of-the-box UNIX LDAP properties. If you have a Server 2003 domain controller, you can use the Microsoft Windows Services for UNIX add-on to extend the LDAP schema to include UNIX properties. (This article does not intend to introduce this scenario.) )

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.