svcadm(8)을 검색하려면 섹션에서 8 을 선택하고, 맨 페이지 이름에 svcadm을 입력하고 검색을 누른다.
ldapclient(8)
ldapclient(8) System Administration Commands ldapclient(8)
NAME
ldapclient - initialize LDAP client machine or output an LDAP client
profile in LDIF format
SYNOPSIS
/usr/sbin/ldapclient [-v | -q] init
[-a adminDN=adminDN]
[-a adminPassword=adminPassword]
[-a authenticationMethod=authenticationMethod]
[-a certificatePath=path]
[-a credentialLevel=[anonymous | proxy | self]]
[-a debugLevel=[0-6]]
[-a defaultServerList=serverList]
[-a domainName=domain]
[-a enableShadowUpdate=[true | false]]
[-a profileName=profileName]
[-a proxyDN=proxyDN]
[-a proxyPassword=password]
[-d bindDN]
[-j passwdFile]
[-w bindPassword]
[-y proxyPasswdFile]
[-z adminPasswdFile]
LDAP_server[:port_number]
/usr/sbin/ldapclient [-v | -q] manual
[-a adminDN=adminDN]
[-a adminPassword=adminPassword]
[-a attributeMap=attributeMap]
[-a authenticationMethod=authenticationMethod]
[-a bindTimeLimit=seconds]
[-a certificatePath=path]
[-a credentialLevel=credentialLevel]
[-a debugLevel=[0-6]]
[-a defaultSearchBase=DN]
[-a defaultSearchScope=[one | sub]]
[-a defaultServerList=serverList]
[-a domainName=domain]
[-a enableShadowUpdate=[true | false]]
[-a followReferrals=[true | false]]
[-a objectClassMap=objectclassMap]
[-a preferredServerList=serverList]
[-a proxyDN=proxyDN]
[-a proxyPassword=password]
[-a searchTimeLimit=seconds]
[-a serviceAuthenticationMethod=attrValue]
[-a serviceCredentialLevel=attrValue]
[-a serviceSearchDescriptor=attrValue]
[-d bindDN]
[-j passwdFile]
[-w bindPassword]
[-y proxyPasswdFile]
[-z adminPasswdFile]
/usr/sbin/ldapclient [-v | -q] mod
[-a adminDN=adminDN]
[-a adminPassword=adminPassword]
[-a authenticationMethod=authenticationMethod]
[-a bindTimeLimit=seconds]
[-a certificatePath=path]
[-a credentialLevel=credentialLevel]
[-a debugLevel=[0-6]]
[-a defaultSearchBase=DN]
[-a defaultSearchScope=[one | sub]]
[-a defaultServerList=serverList]
[-a domainName=domain]
[-a enableShadowUpdate=[true | false]]
[-a followReferrals=[true | false]]
[-a preferredServerList=serverList]
[-a proxyDN=proxyDN]
[-a proxyPassword=password]
[-a searchTimeLimit=seconds]
[-d bindDN]
[-j passwdFile]
[-w bindPassword]
[-y proxyPasswdFile]
[-z adminPasswdFile]
/usr/sbin/ldapclient [-v | -q] list
/usr/sbin/ldapclient [-v | -q] uninit
/usr/sbin/ldapclient [-v | -q] genprofile
[-a attributeMap=attributeMap]
[-a authenticationMethod=authenticationMethod]
[-a bindTimeLimit=seconds]
[-a credentialLevel=credentialLevel]
[-a defaultSearchBase=DN]
[-a defaultSearchScope=[one | sub]]
[-a defaultServerList=serverList]
[-a followReferrals=[true | false]]
[-a objectClassMap=objectClassMap]
[-a preferredServerList=serverList]
[-a profileName=profileName]
[-a profileTTL=integer]
[-a searchTimeLimit=seconds]
[-a serviceAuthenticationMethod=attrValue]
[-a serviceCredentialLevel=attrValue]
[-a serviceSearchDescriptor=attrValue]
DESCRIPTION
The ldapclient utility can be used to perform a number of tasks based
on given subcommand:
o init: initialize LDAP client machines from a profile stored
on a directory server.
o uninit: restore the previous network service environment on
this LDAP client.
o list: Display the contents of the LDAP client cache in human
readable format.
o mod: Modify a previously manually configured config.
o genprofile: Generate a profile for a server.
See SUBCOMMANDS section for more details.
OPTIONS
The following options are supported:
-a attrName=attrValue
Specify attrName and its value. Refer to the SYNOPSIS for where
specific attrName's can be used and LDAP Attributes for a complete
list of attribute names and values.
-D bindDN
bindDN specifies the Distinguished Name used to bind to the LDAP
directory. It must have read permission for the requested database.
-j passwdFile
Specify a file containing the password for the bindDN or the pass‐
word for the SSL client's key database. To protect the password,
use this option in scripts and place the password in a secure file.
This option is mutually exclusive of the -w option.
-q
Quiet mode. No output is generated.
-v
Verbose output. Specifying additional -v options displays more de‐
tailed information.
-w bindPassword
Password to be used for authenticating the bindDN.
Warning: use of this option is discouraged, see SECURITY section,
use -j passwdFileinstead.
If bindPassword is not set or if you supply "-" (hyphen) as a pass‐
word, the command will prompt for a password.
-y proxyPasswdFile
Specify a file containing the password for the proxyDN. To protect
the password, use this option in scripts and place the password in
a secure file. This option is mutually exclusive of the
-a proxyPassword option.
-z adminPasswdFile
Specify a file containing the password for the adminDN. To protect
the password, use this option in scripts and place the password in
a secure file. This option is mutually exclusive of the
-a adminPassword option.
SUBCOMMANDS
The following subcommands are supported:
init LDAP_server
Initializes an LDAP client machine from a profile that is stored on
the specified LDAP_server; a single address or name with optional
port as described in Server List.
Once the profile is loaded, the preferredServerList and
defaultServerList specified in the profile are used; LDAP_server
becomes irrelevant.
The LDAP client uses the attributes in the specified profile to de‐
termine the configuration of the LDAP client. Using a configuration
profile enables you to easily install the LDAP client and propagate
the configuration changes to LDAP clients. The ldap_cachemgr daemon
updates the LDAP client configuration when its cache expires by
reading the profile. For more information about the configuration
profile, see IETF RFC4876 A Configuration Schema for LDAP Based
Directory User Agents.
manual
Manually initialize client with the specified attribute values;
known also as Manual Mode.
The LDAP client will use the attributes specified on the command
line. Any unspecified attributes will be assigned their default
values. At least one server must be specified in the
defaultServerList or the preferredServerList attributes. The
domainName attribute must be specified if the client's domain name
is not set; sysinfo(2) SI_SRPC_DOMAIN
mod
Modify attribute values in the configuration file after a manual
initialization of the client.
This option modifies only those LDAP client configuration attrib‐
utes specified on the command line. The mod option should only be
used on LDAP clients that were initialized using the manual option.
list
Write the contents of the LDAP client cache to standard output in
human readable form. LDAP configuration files are not guaranteed to
be human readable.
Note that the values for adminDN, proxyDN, adminPassword and
proxyPassword are not displayed for security reasons.
uninit
Uninitialize an LDAP client, restoring it to the state it was in
prior to the last execution of ldapclient using init or manual. It
uses the backup files created by those options.
genprofile
Generate a configuration profile in LDIF format that can then be
stored in the directory for clients to use, with the init form of
this command.
The formatted configuration profile is written to standard output
based on the attributes specified on the command line. This profile
can then be loaded into an LDAP server to be used as the client
profile, which can be downloaded by means of the ldapclient init
command. Loading the LDIF formatted profile to the directory server
can be done through ldapadd, or through any server specific import
tool.
Note that the attributes proxyDN, proxyPassword, certificatePath,
domainName, enableShadowUpdate, adminDN, and adminPassword are not
part of the configuration profile and thus are not permitted.
LDAP Attributes
ldapclient attribute pairs are made up of attribute=value pairs as per
RFC4876. The following attributes are supported by ldapclient, though
some subcommands limit what can be specified; see SYNOPSIS:
adminDN
Specify the Bind Distinguished Name for the administrator identity
that is used for shadow information update. This option is required
if the credential level is proxy, and enableShadowUpdate is set to
true. There is no default value.
adminPassword
Specify the administrator password.
Warning: The setting of this attribute on the command line is dis‐
couraged, see SECURITY section, use -z adminPasswdFile option in‐
stead.
A adminPassword is required if the credential level is proxy, and
enableShadowUpdate is set to true. There is no default value.
attributeMap
Specify a mapping from an attribute defined by a service to an at‐
tribute in an alternative schema. This can be used to change the
default schema used for a given service. The syntax of attributeMap
is defined in the profile IETF draft. This option can be specified
multiple times. The default value for all services is NULL. In the
example,
attributeMap: passwd:uid=employeeNumber
the LDAP client would use the LDAP attribute employeeNumber rather
than uid for the passwd service. This is a multi-valued attribute.
authenticationMethod
Specify the default authentication method used by all services un‐
less overridden by the serviceAuthenticationMethod attribute.
Multiple values can be specified by using a semicolon-separated
list. The default value is none.
For those services that use credentialLevel and credentialLevel is
anonymous, this attribute is ignored.
Services such as pam_ldap(7) will use this attribute, even if
credentialLevel is anonymous.
The supported Authentication Methods are described below.
bindTimeLimit
The maximum time in seconds that a client should spend performing a
bind operation. Set this to a positive integer. The default value
is 30.
debugLevel
Sets the ldap_cachemgr(8) debug option level. Set this to a posi‐
tive integer between 0 and 6. The default value of 0, disables de‐
bugging.
certificatePath
The certificate path for the location of the certificate files. The
value is the path where PEM format certificate files reside. This
is used for TLS support, which is specified in the
authenticationMethod and serviceAuthenticationMethod attributes.
The default is /var/ldap.
credentialLevel
Specify the credential level the client should use to contact the
directory. The credential levels supported are anonymous, proxy,
and self.
Refer to Credential Level below for details.
defaultSearchBase
Specify the default search base DN. There is no default. The
serviceSearchDescriptor attribute can be used to override the
defaultSearchBase for given services.
defaultSearchScope=one | sub
Specify the default search scope for the client's search opera‐
tions. This default can be overridden for a given service by speci‐
fying a serviceSearchDescriptor. The default is one level search.
defaultServerList
A Server List (defined below) that is used after any server listed
in the preferredServerList. Priority is not given to the order,
whichever one works is used and not overridden except when a pre‐
ferred server becomes available.
At least one server must be listed in either preferredServerList or
defaultServerList.
domainName
Specify the DNS domain name. This becomes the default domain for
the machine. The default is the current domain name. This attribute
is only used in client initialization.
enableShadowUpdate=true | false
Specify whether the client is allowed to update Shadow Data (de‐
fined below). If set to true and the credential level is proxy then
adminDN and adminPassword must be specified.
followReferrals=true | false
Specify the referral setting. A setting of true implies that refer‐
rals will be automatically followed and false would result in re‐
ferrals not being followed. The default is true.
objectclassMap
Specify a mapping from an objectclass defined by a service to an
objectclass in an alternative schema.
This can be used to change the default schema used for a given ser‐
vice. The syntax of objectclassMap is defined in the profile IETF
draft. This option can be specified multiple times. The default
value for all services is NULL. In the example,
objectclassMap=passwd:posixAccount=unixAccount
The LDAP client would use the LDAP objectclass of unixAccount
rather than the posixAccount for the passwd service. This is a
multi-valued attribute.
preferredServerList
A Server List (defined below) of servers to be contacted before
servers specified by the defaultServerList attribute.
Entries are in priority order, highest priority first. For example
if three servers were listed, the first will be used unless that
connection fails (goes offline). Only then is the second in the
list used, and if that connection goes offline then the third would
be used; and so on. When a higher priority server comes back online
it will used again and replace any connection to a lower priority
server even when that is still online.
At least one server must be listed in either preferredServerList or
defaultServerList.
profileName
Specify the profile name. For ldapclient init, this attribute is
the name of an existing profile which may be downloaded periodi‐
cally depending on the value of the profileTTL attribute. The de‐
fault value is default.
For ldapclient genprofile, this is the name of the profile to be
generated.
profileTTL
Specify the Time To Live value in seconds for the client profile
information. ldap_cachemgr uses this value to determine when to
check, and if necessary download, its profile.
Valid values are either 0 (zero) for no expiration, or a positive
integer in seconds. The default value is 43200 (12 hours) or 0 for
manual configurations.
Note that setting svc:network/ldap/client:default property manually
to config/profileTTL = 0 after a profile has been downloaded is the
equivalent of setting manual mode. No further updates will be taken
from the server.
proxyDN
Specify the Bind Distinguished Name for the proxy identity. This
option is required if the credential level is proxy, and at least
one of the authentication methods requires a bind DN. There is no
default value.
proxyPassword
Specify client proxy password.
Warning: The setting of this attribute on the command line is dis‐
couraged, see SECURITY section, use -y proxyPasswdFile option in‐
stead.
A proxyPassword is required if the credential level is proxy, and
at least one of the authentication methods requires a bind DN.
There is no default.
searchTimeLimit
Specify maximum number of seconds allowed for an LDAP search opera‐
tion. The default is 30 seconds. The server may have its own search
time limit.
serviceAuthenticationMethod
Specify authentication methods to be used by a service in the form
service:authenticationMethod, for example:
pam_ldap:tls:simple
For multiple authentication methods, use a semicolon-separated
list. The default value is no service authentication methods, in
which case, each service would default to the authenticationMethod
value. The supported authentications are described above.
Three services support this feature: passwd-cmd, keyserv, and
pam_ldap. The passwd-cmd service is used to define the authentica‐
tion method to be used by passwd(1) to change the user's password
and other attributes. The keyserv service is used to identify the
authentication method to be used by the chkey(1) and newkey(8)
utilities. The pam_ldap service defines the authentication method
to be used for authenticating users when pam_ldap(7) is configured.
If this attribute is not set for any of these services, the
authenticationMethod attribute is used to define the authentication
method. This is a multi-valued attribute.
serviceCredentialLevel
Specify credential level to be used by a service. Multiple values
can be specified in a space-separated list. The default value for
all services is NULL.
The supported credential levels are: anonymous or proxy. At
present, no service uses this attribute. This is a multi-valued at‐
tribute.
serviceSearchDescriptor
Override the default base DN for LDAP searches for a given service.
The format of the descriptors also allow overriding the default
search scope and search filter for each service.
The syntax of serviceSearchDescriptor is defined in the profile
IETF draft. The default value for all services is NULL. This is a
multi-valued attribute.
In the example,
serviceSearchDescriptor=passwd:ou=people,dc=a1,dc=example,dc=com?one
the LDAP client would do a one level search in ou=peo‐
ple,dc=a1,dc=example,dc=com rather than ou=people,defaultSearchBase
for the passwd service.
Server List
Both serverList and preferredServerList attributes take a space sepa‐
rated list of server names or server addresses, either IPv4 or IPv6,
optionally appended with port number. When a port number is not speci‐
fied it defaults to LDAP server port number 389 unless a TLS Authenti‐
cation Method is specified.
Where TLS authentication is used and no port is specified both port 389
with STARTTLS and 636 for raw TLS will be tried, and which ever one
works first will be the port used. When a port is specified for TLS
then STARTTLS and raw TLS on that port will be tried and the first that
works will be used.
The format to specify the port number for an IPv6 address is:
[ipv6_addr]:port
To specify the port number for an IPv4 address, use the following for‐
mat:
ipv4_addr:port
If the host name is specified, use the format:
host_name:port
If you specify server names, be sure that the LDAP client can resolve
them without the LDAP name service. They must resolve from either
nsswitch.conf(5)'s files (hosts(5)) or dns (resolv.conf(5)) backends.
Note that ldapclient initialization copies /etc/nsswitch.ldap to
/etc/nsswitch.conf and updates SMF accordingly, for example:
$ svccfg -s name-service/switch listprop config/host
config/host astring "files dns"
It does not set up the client to resolve hostnames using DNS. Refer to
the DNS documentation for information on setting up DNS in re‐
solv.conf(5).
Note that for sasl/GSSAPI DNS should be used.
Certificates used with TLS should include fully qualified domain names
and not just a host name or IP address. The FQDN must resolve cor‐
rectly. This is a common problem particularly with self-signed certifi‐
cates, the LDAP server's hostname must match the CN or a DNS record
within the X509v3 Subject Alternative Name.
To see the certificates being offered by your LDAP server use the
s_client(1openssl) command:
$ /usr/openssl/3/bin/openssl s_client -starttls ldap -servername ldap.example.com -connect ldap.example.com
If the LDAP server name cannot be resolved or TLS is configured using
self-signed certificates and FQDN does not match the names provided in
the certificate the LDAP naming service will fail.
Credential Level
Specify the credential level the client should use to contact the di‐
rectory. The credential levels supported are
anonymous The client does not authenticate to the directory. No LDAP
bind operation occurs.
When credentialLevel is anonymous the following warning is
produced
Warning: Using anonymous credential level
(non-integrity-protected)!
Use an alternative credentialLevel to protect the in‐
tegrity of data passed to the directory server.
proxy A proxy configuration refers to using an account setup on
the directory server for lookups, such as that provided by
ldapservercfg(8). A client can only have one proxy ac‐
count. Different clients or groups of clients, can have
their own proxy account.
The authenticationMethod attribute must be specified to
determine the Authentication Mechanism.
When authenticationMethod property is set to sasl/GSSAPI,
all lookups use the host's Kerberos principal.
If at least one of the authentication methods require a
bind DN, the proxyDN and proxyPassword attribute values
need to be provided or ldapclient will prompt for their
values.
Note that NULL passwords are not allowed in LDAP.
self A self configuration refers to the users own account mak‐
ing the lookups. The authenticationMethod must be
sasl/GSSAPI.
A summary of Credential Levels and Authentication Methods is provided
below.
Authentication Methods
To access the information stored in the directory, clients can either
authenticate to the directory, or use an unauthenticated connection.
Values for attribute authenticationMethod and
serviceAuthenticationMethod are further explained here.
none
The client does not authenticate to the directory. No LDAP bind op‐
eration occurs. This method is equivalent to the anonymous Creden‐
tial Level (credentialLevel attribute)>.
simple
The client system sends the userâs password in the clear to bind to
the LDAP server. The password is subject to snooping unless the
session is protected by IPsec such as tls:simple provides.
This method is easy to set up and all directory servers support it.
It should not be used in production environments.
Note that Oracle does not recommend using the none authentication
method in combination with the simple credential level.
Using tls:simple or sasl/GSSAPI with encryption enabled is recom‐
mended.
sasl/CRAM-MD5
Do not use this obsolete authentication method.
The primary advantage of sasl/CRAM-MD5 (Challenge Response Authen‐
tication Mechanism) over the simple Authentication Method is that
the password is not sent in clear text during authentication. Refer
to RFC 2195 for information on CRAM-MD5.
sasl/DIGEST-MD5
Do not use this obsolete authentication method.
The primary advantage of sasl/DIGEST-MD5 over the simple Authenti‐
cation Method is that the password is not sent in clear text during
authentication. Refer to RFC 2831 for information on digest-MD5.
sasl/GSSAPI
This authentication method is used in conjunction with nscd per-
user mode to enable per-user lookups. In per-user mode a separate
nscd process runs for each user which binds to the server using the
sasl/GSSAPI method and the userâs kerberos(7) credentials. The per-
user nscd process then performs all the user's lookups using the
user's Kerberos principal. Access can be controlled in the direc‐
tory server on a per-user basis. See the enable_per_user_lookup
property of nscd.conf(5).
Note that users with a UID of 0 use the host's Kerberos principal.
All other users must define and initialize their respective Ker‐
beros principal. Defining and initializing the Kerberos principal
applies to every user that is defined in any of the configured nam‐
ing repositories, including /etc/passwd, if those users perform
naming lookups.
Note that for sasl/GSSAPI nsswitch.conf(5) should use DNS. Refer
to Server List definition.
tls:simple
The client establishes a TLS connection and then binds using the
simple method. The whole session is encrypted. The password is pro‐
tected.
tls:sasl/CRAM-MD5
The LDAP session is encrypted and the client authenticates to the
directory server using sasl/cram-MD5.
tls:sasl/DIGEST-MD5
The LDAP session is encrypted and the client authenticates to the
directory server using sasl/digest-MD5.
A summary of Credential Levels and Authentication Methods is provided
below.
Shadow Update
Shadow update / shadow data is a feature by which certain information
can be updated on the LDAP server. For example password aging and ac‐
count locking (shadow(5)), adding users with useradd(8), etc.
An administrator's credentials with write access to necessary data on
the LDAP server must be provided using attributes adminDN and
adminPassword.
Summary of Credential Levels and Authentication Methods
A summary of the various Credential (Cred) levels with the Authentica‐
tion (Auth) Methods provides a clear status as to the security of login
and data on the wire, whether a bind occurs, and if Shadow Data is
available. Refer to the sections above for further details and also the
SECURITY and CAUTION sections below.
Table 1 Summary of Credential Levels and Authentication Methods
tab(); lw(1.27i) |lw(1.27i) |lw(0.42i) |lw(0.85i) |lw(0.85i) |lw(0.85i)
lw(1.27i) |lw(1.27i) |lw(0.42i) |lw(0.85i) |lw(0.85i) |lw(0.85i) Cred
LevelAuth MethodBindShadowSecureNotes _ anonymousnoneNoNo[1][2] _
anonymoussimpleNoNo[1][2] _ anonymoustls:simpleNoNo[1][2] _ proxysim‐
pleYesYesNo[2][3] _ proxysasl/CRAM-MD5YesYesNo[4] _ proxysasl/DIGEST-
MD5YesYesNo[4] _ proxytls:*YesYesYes[3][5] _ selfsasl/GSS‐
APIYesYesYes[6][7]
Note that some directory servers may not support all of these authenti‐
cation methods.
1. The anonymous Credential Level causes Authentication Method
to be ignored.
2. Login passwords and all other data is clearly visible!
3. A bind occurs using proxyDN
4. As an authentication method these are considered weak. Use
an alternative method or use with TLS.
5. Using TLS causes the bind and all data to be encrypted.
6. Users Kerberos credentials are used.
7. The level of encryption is dependent on the servers configu‐
ration.
SECURITY
You must have the Name Service Management rights profile to run the
ldapclient command, except with the genprofile option.
EXAMPLES
Example 1 Setting Up a Client By Using the Default Profile Stored on a
Specified LDAP Server
The following example shows how to set up a client using the default
profile stored on the specified LDAP server. This command will only be
successful if either the credential level in the profile is set to
anonymous or the authentication method is set to none as no credential
information is given.
example# ldapclient init 172.16.100.1
Example 2 Setting Up a Client By Using the simple Profile Stored on a
Specified LDAP Server
The following example shows how to set up a client using the simple
profile stored on the specified LDAP server. The domainName is set to
xyz.example.com and the proxyPassword is secret.
example# ldapclient init -a profileName=simple \
-a domainName=xyz.example.com \
-a proxyDN=cn=proxyagent,ou=profile,dc=xyz,dc=example,dc=com \
-a proxyPassword=secret '['fe80::a00:20ff:fea3:388']':386
Example 3 Setting Up a Client Using Only One Server
The following example shows how to set up a client using only one
server. The authentication method is set to none, and the search base
is dc=example,dc=com.
example# ldapclient manual -a authenticationMethod=none \
-a defaultSearchBase=dc=example,dc=com \
-a defaultServerList=172.16.100.1
Example 4 Setting Up a Client Using Only One Server That Does Not Fol‐
low Referrals
The following example shows how to set up a client using only one
server. The credential level is set to proxy. The authentication method
of is sasl/CRAM-MD5, with the option not to follow referrals. The do‐
main name is xyz.example.com, and the LDAP server is running on port
number 386 at IP address 172.16.100.1.
example# ldapclient manual \
-a credentialLevel=proxy \
-a authenticationMethod=sasl/CRAM-MD5 \
-a proxyPassword=secret \
-a proxyDN=cn=proxyagent,ou=profile,dc=xyz,dc=example,dc=com \
-a defaultSearchBase=dc=xyz,dc=example,dc=com \
-a domainName=xyz.example.com \
-a followReferrals=false \
-a defaultServerList=172.16.100.1:386
Example 5 Using genprofile to Set Only the defaultSearchBase and the
Server Addresses
The following example shows how to use the genprofile command to set
the defaultSearchBase and the server addresses.
example# ldapclient genprofile -a profileName=myprofile \
-a defaultSearchBase=dc=eng,dc=example,dc=com \
-a "defaultServerList=172.16.100.1 172.16.234.15:386" \
> myprofile.ldif
Example 6 Creating a Profile on IPv6 servers
The following example creates a profile on IPv6 servers
example# ldapclient genprofile -a profileName=eng \
-a credentialLevel=proxy \
-a authenticationMethod=sasl/DIGEST-MD5 \
-a defaultSearchBase=dc=eng,dc=example,dc=com \
-a "serviceSearchDescriptor=passwd:ou=people,dc=a1,dc=example,dc=com?one"\
-a preferredServerList= '['fe80::a00:20ff:fea3:388']' \
-a "defaultServerList='['fec0::111:a00:20ff:fea3:edcf']' \
'['fec0::111:a00:20ff:feb5:e41']'" > eng.ldif
Example 7 Creating a Profile That Overrides Every Default Value
The following example shows a profile that overrides every default
value.
example# ldapclient genprofile -a profileName=eng \
-a credentialLevel=proxy -a authenticationMethod=sasl/DIGEST-MD5 \
-a bindTimeLimit=20 \
-a defaultSearchBase=dc=eng,dc=example,dc=com \
-a "serviceSearchDescriptor=passwd:ou=people,dc=a1,dc=example,dc=com?one"\
-a serviceAuthenticationMethod=pam_ldap:tls:simple \
-a defaultSearchScope=sub \
-a attributeMap=passwd:uid=employeeNumber \
-a objectclassMap=passwd:posixAccount=unixAccount \
-a followReferrals=false -a profileTTL=6000 \
-a preferredServerList=172.16.100.30 -a searchTimeLimit=30 \
-a "defaultServerList=172.16.200.1 172.16.100.1 192.168.5.6" \
> eng.ldif
EXIT STATUS
The following exit values are returned:
0 The command successfully executed.
1 An error occurred. An error message is output.
2 proxyDN and proxyPassword attributes are required, but they are
not provided.
FILES
svc:/network/ldap/client
The naming service-specific configuration properties are stored in
the SMF service. Modifying the SMF properties directly is not ad‐
vised. Use ldapclient instead.
/var/ldap/ldap_client_cred
/var/ldap/ldap_client_file
Contain the LDAP configuration of the client. These files are not
to be modified manually. Their content is not guaranteed to be hu‐
man readable. Use ldapclient to update them.
/var/ldap/restore
Backup directory for previous configuration files modified during
init or manual installation.
o /etc/nsswitch.conf
o /etc/defaultdomain (if it exists)
o /var/yp/binding/`domainname` (for a NIS [YP] client)
/etc/defaultdomain
System default domain name, matching the domain name of the data in
the LDAP servers. See defaultdomain(5).
/etc/nsswitch.conf
Configuration file for the name-service switch. See nss‐
witch.conf(5).
/etc/nsswitch.ldap
Sample configuration file for the name-service switch configured
with LDAP, files, and DNS.
ATTRIBUTES
See attributes(7) for descriptions of the following attributes:
tab() box; cw(2.75i) |cw(2.75i) lw(2.75i) |lw(2.75i) ATTRIBUTE TYPEAT‐
TRIBUTE VALUE _ Availabilitysystem/network/ldap _ Interface Stability‐
Committed
SEE ALSO
chkey(1), ldaplist(1), passwd(1), sysinfo(2), defaultdomain(5),
hosts(5), nscd.conf(5), nsswitch.conf(5), resolv.conf(5), attrib‐
utes(7), kerberos(7), ldap(7), pam_ldap(7), idsconfig(8),
ldap_cachemgr(8), ldapaddent(8), newkey(8), nscd(8)
RFC 4876: A Configuration Schema for LDAP Based Directory User Agents:
https://datatracker.ietf.org/doc/rfc4876/
CAUTION
The CRAM-MD5 and DIGEST-MD5 mechanisms are considered weak, obsolete,
and insecure. They should not be used without an encrypted TLS connec‐
tion.
Specifying passwords on the command line with attributes adminPassword,
proxyPassword or option -w is not recommended. Usage of these exposes
the password, making them visible through commands such as ps(1), in
shell history and or in scripts.
The simple method causes the user's bind password to be sent in the
clear, unencrypted, to the LDAP server, meaning that the users identity
and password could be captured from the network using tools such as
snoop or tshark. To protect the authentication and session data use the
proxy Credential Level and an Authentication Method that uses Trans‐
port Layer Security (TLS) to encrypt the entire session. The appropri‐
ate PEM certificate files used on the server will need to be installed
on the client to use TLS (see certificatePath attribute). When an
authenticationMethod would cause passwords to be exposed in network
traffic ldapclient displays (and ldap_cachemgr(8) logs) a warning iden‐
tifying the faulty method, for example:
Warning: Using non-integrity-protected authentication method: simple
NOTES
Both StartTLS and raw TLS are supported. A StartTLS request will be
used on any connection not specifying port 636.
For example:
defaultServerList= foo:636 bar:1000 baz:389
authenticationMethod= tls:simple
This will attempt a raw TLS open on port 636, followed by an insecure
connection on port 1000 with a StartTLS request to secure the connec‐
tion, finally followed by a similar insecure connection and follow-up
StartTLS request on port 389.
This is somewhat different than the behavior observed on older Solaris
systems. On older systems, in all three cases the system would attempt
a raw TLS connection on all three hosts, on those specified ports. A
single port servicing both secure and not secure connections was not
supported.
In the following example, there will be a significant timeout delay
while attempting the connection to foo:636:
defaultServerList= foo:636 foo:389
authenticationMethod= simple
This is because port 636 is normally the default TLS port and and "sim‐
ple" authentication will not attempt an SSL or StartTLS connection on
that port. A delay will occur while waiting for the connection to
foo:636 to fail, followed by a successful retry on foo:389.
The LDAP client's SMF properties are contained in the svc:/net‐
work/ldap/client service. In addition to the SMF properties managed by
the ldapclient tool, and described above, the following SMF property
controls the LDAP client.
config/group_return_members
Controls what users as part of the user or member list are returned
when obtaining a group from an LDAP server. This applies to getting
a group specified by name or GID or through enumeration.
The possible property values are:
"nomember" Stops the LDAP client from fetching the LDAP at‐
tributes, "member" and "uniqueMember", and not re‐
turning the associated users as part of the user
or member list. Values of these attributes are the
group members' LDAP Distinguished Name.
"nomemberuid" Stops the LDAP client from fetching the LDAP at‐
tribute, "memberUid", and not returning the asso‐
ciated users as part of the user or member list.
Values of the attribute are the group members'
user name.
Processing group members which are Distinguished Name values can be ex‐
pensive as each Distinguished Name value can require a further LDAP
lookup to find the user name. The Distinguished Name values can also be
other LDAP groups which need to be processed to find all the group mem‐
bers.
Setting "nomember" changes Solaris to pre Solaris 11 behavior where
group user or member list was just by the LDAP "memberUid" attribute.
This control does not affect what groups are returned by getgrouplist()
or groups.
Ensure that the svc:/system/name-service/cache service is enabled and
online for the ldap(7) services to function correctly. Note that the
nscd service is enabled by default. See the nscd(8) man page.
HISTORY
The Solaris 8 OS introduced the ldapclient command.
The Oracle Solaris 10 OS introduced the svc:/network/ldap/client ser‐
vice.
Starting with Oracle Solaris 11.4, nscd daemon must be running for
ldap(7) services to function correctly.
Oracle Solaris 11.4 6 Aug 2025 ldapclient(8)