Naming and Directory Services (DNS, NIS, and LDAP)

LDAP Naming Services Security ModelIntroductionSolaris LDAP naming services use the LDAP repository as a source of both a namingservice and an authentication service. This section discusses the concepts of clientidentity, authentication methods, pam_ldap(5) and pam_unix modules, and accountmanagement.Note – After you enable pam_ldap account management, all users must provide apassword any time they log in to the system. A login password is required forauthentication. Therefore, nonpassword-based logins using tools such as rsh,rlogin, orssh will fail.To access the information in the LDAP repository, clients can first establish identitywith the directory server. This identity can be either anonymous or as an objectrecognized by the LDAP server. Based on the client’s identity and the server’s accesscontrol information (ACI), the LDAP server will allow the client to read or writedirectory information. For more information on ACIs, consult the Administration Guidefor the version of Sun Java System Directory Server that you are using.If the client is connecting as anything other than anonymous for any given request, theclient must prove its identity to the server using an authentication method supportedby both the client and the server. Once the client has established its identity, it can thenmake the various LDAP requests.There is a distinction between how the naming service and the authentication service(pam_ldap) access the directory. The naming service reads various entries and theirattributes from the directory based on predefined identity. The authentication serviceestablishes whether the user has entered the correct password by using that user’sname and password to authenticate to the LDAP server. See the pam_ldap(5) manpage for more information about the authentication service.Chapter 9 • LDAP Basic Components and Concepts (Overview) 141