Naming and Directory Services (DNS, NIS, and LDAP)

LDAP Configuration Problems andSolutionsThe following sections describe LDAP configuration problems and suggests solutionsto the problems.Unresolved HostnameThe Solaris platform LDAP client back end returns fully qualified host names for hostlookups, such as host names returned by gethostbyname() and getaddrinfo().If the name stored is qualified, that is, contains at least one dot, the client returns thename as is. For example, if the name stored is hostB.eng, the returned name ishostB.eng.If the name stored in the LDAP directory is not qualified (it does not contain a dot),the client back end appends the domain part to the name. For example, if the namestored is hostA, the returned name is hostA.domainname.Unable to Reach Systems in the LDAP DomainRemotelyIf the DNS domain name is different from the LDAP domain name, then the LDAPnaming service cannot be used to serve host names unless the host names are storedfully qualified.Login Does Not WorkLDAP clients use the PAM modules for user authentication during login. When usingthe standard UNIX PAM module, the password is read from the server and checkedon the client side. This can fail due to one of the following reasons:1. ldap is not used by the passwd service in the /etc/nsswitch.conf file.2. The user’s userPassword attribute on the server list is not readable by the proxyagent. You need to allow at least the proxy agent to read the password because theproxy agent returns it to the client for comparison. pam_ldap does not requireread access to the password.3. The proxy agent might not have the correct password.4. The entry does not have the shadowAccount object class.192 System Administration Guide: Naming and Directory Services (DNS, NIS, and LDAP) • January 2005