Table of Contents

Ubuntu AD Backend

ldap to AD/nss

nss gets the user lists from ldap (not passwords though)

install stuff

sudo apt-get update
sudo apt-get install nslcd

configuring

LDAP Server Host Address: 

ldaps://ad1.acm.cs
ldaps://ad2.acm.cs
ldaps://ad3.acm.cs

distinguished name of the search base: DC=acm,DC=cs

Ldap Version: 3

get root ldap access: no

Does Ldap require login: yes

Unprivileged database user: apacheacm@acm.cs

Password for database login account: (get this from a sysadmin) (syadmin hint: look in /etc/apache2/sites-enabled/acm.cs.uic.edu-secure on acm)

getting the settings

The defaults for any values not listed here should be fine

anything listed here needs to be uncommented or changed

/etc/ldap.conf

# RFC 2307 (AD) mappings
nss_map_objectclass posixAccount user
nss_map_objectclass shadowAccount user
nss_map_attribute uid sAMAccountName
nss_map_attribute homeDirectory unixHomeDirectory
nss_map_attribute shadowLastChange pwdLastSet
nss_map_objectclass posixGroup group
nss_map_attribute uniqueMember member
pam_login_attribute sAMAccountName
pam_filter objectclass=User
pam_password ad


# Disable SASL security layers. This is needed for AD.
sasl_secprops maxssf=0

nssswitch

add “ldap” after passwd, group and shadow

/etc/nssswitch.conf

# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd:         files ldap
group:          files ldap
shadow:         files ldap

hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis

restart service

sudo service nslcd restart

first test

If you everything works correctly up until this point: 

getent passwd

should list all the AD users as well as the system users

kerberos

kerberos handles authentication of users. (passwords)

install stuff

apt-get install krb5-user
apt-get install krb5-config
apt-get install libpam-krb5

krb5.conf

make changes to the following 2 sections of /etc/krb5.conf

/etc/krb5.conf

[libdefaults]
        default_realm = ACM.CS
        dns_lookup_realm = false
        dns_lookup_kdc = true

[realms]

[domain_realm]
        acm.cs = ACM.CS
        .acm.cs = ACM.CS

[logging]
#       kdc = CONSOLE