Follow Techotopia on Twitter

On-line Guides
All Guides
eBook Store
iOS / Android
Linux for Beginners
Office Productivity
Linux Installation
Linux Security
Linux Utilities
Linux Virtualization
Linux Kernel
System/Network Admin
Programming
Scripting Languages
Development Tools
Web Development
GUI Toolkits/Desktop
Databases
Mail Systems
openSolaris
Eclipse Documentation
Techotopia.com
Virtuatopia.com

How To Guides
Virtualization
General System Admin
Linux Security
Linux Filesystems
Web Servers
Graphics & Desktop
PC Hardware
Windows
Problem Solutions
Privacy Policy

  




 

 

System Administration Guide: Naming and Directory Services (DNS, NIS, and LDAP)
Previous Next

How the nss_ad Naming Service Module Retrieves Data From AD

The following section describes how the nss_ad module resolves naming service requests for the passwd, shadow, and group files by retrieving corresponding data from AD.

Retrieving passwd Information

The following syntax shows the proper form of a passwd entry:

username:password:uid:gid:gecos:home-directory:login-shell

See the passwd(4) man page for more information.

The nss_ad module retrieves passwd information from AD as follows:

  • username Field uses the value of the samAccountName AD attribute and is qualified by the domain name in which the object resides, for example, [email protected].

  • password Field uses the value of x because the user password is not available in the AD object.

  • uid Field uses the Windows user's SID from the objectSID AD attribute, which is mapped to the UID by using the idmap service.

  • gid Field uses the Windows user's primary group SID, which is mapped to the GID by using the idmap service. The group SID is obtained by appending the value of the primaryGroupID AD attribute to the domain SID. For users in AD, the primaryGroupID attribute is an optional attribute, so it might not exist. If the attribute does not exist, nss_ad uses the idmap diagonal mapping facility to map the user SID from the objectSID attribute.

  • gecos Value of the CN AD attribute.

  • home-directory Value of the homeDirectory AD attribute, if a value exists. Otherwise, the field is left empty.

  • login-shell Field is left empty because there is no login shell attribute in the native AD schema.

Retrieving shadow Information

The following syntax shows the proper form of a shadow entry:

username:password:lastchg:min:max:warn:inactive:expire:flag

See the shadow(4) man page for more information.

The nss_ad module retrieves shadow information from AD as follows:

  • username Field uses the value of the samAccountName AD attribute and is qualified by the domain name in which the object resides, for example, [email protected].

  • password Field uses the value of *NP* because the user password is not available in the AD object.

The rest of the shadow fields are left empty because shadow fields are irrelevant with AD and Kerberos v5.

Retrieving group Information

The following syntax shows the proper form of a group entry:

groupname:password:gid:user-list

See the group(4) for man page for more information.

The nss_ad module retrieves information from AD as follows:

  • groupname Field uses the value of the samAccountName AD attribute and is qualified by the domain name in which the object resides, for example, [email protected].

  • password Field is left empty because the Windows groups do not have passwords.

  • gid Field uses the Windows group's SID from the objectSID AD attribute, which is mapped to the GID by using the idmap service.

  • user-list Field is left empty.

Previous Next

 
 
  Published under the terms fo the Public Documentation License Version 1.01. Design by Interspire