LDAP Naming Service Security Model
The basis for user authentication differs depending on the PAM module. LDAP can use the
following PAM modules:
■
pam_krb5 module – Uses the Kerberos server for authentication. For more information, see
the pam_krb5(5) man page. For a more extensive description about Kerberos, see Managing
Kerberos and Other Authentication Services in Oracle Solaris 11.3.
■
pam_ldap module – Uses the LDAP server and local host server for authentication. For
more information, see the pam_ldap(5) man page. For information about using the pam_ldap
module, see “LDAP Account Management” on page 27.
■
Equivalent pam_unix_* modules – Information is provided by the system and the
authentication is determined locally.
Note - The pam_unix module is no longer supported in Oracle Solaris. This module has been
replaced by a different set of service modules that provides equivalent or greater functionality.
In this book, pam_unix refers to the modules that provide equivalent functionality, not to the
pam_unix module.
If the pam_ldap module is used, the naming service and the authentication service access the
directory in the following ways:
■
The naming service reads various entries and their attributes from the directory based on
predefined identity.
■
The authentication service authenticates a user’s name and password with the LDAP server
to determine whether the correct password has been specified.
You can use Kerberos and LDAP at the same time to provide both authentication and naming
services to the network. With Kerberos, you can support a single sign-on (SSO) environment in
the enterprise. You can use the Kerberos identity system for querying LDAP naming data on a
per-user or per-host basis.
If you use Kerberos to perform authentication, enable LDAP naming services as a requirement
of the per-user mode. Kerberos can provide dual functions: It authenticates to the LDAP server
and the Kerberos identity for the user or host is used to authenticate to the directory. In this way,
the same user identity that is used to authenticate to the system is also used to authenticate to
the directory for lookups and updates. If required, you can use ACI in the directory to limit the
results out of the naming service.
Transport Layer Security
You can use Transport Layer Security (TLS) to secure communication between an LDAP client
and the directory server and hence ensure both privacy and data integrity. The TLS protocol is a
16 Working With Oracle Solaris 11.3 Directory and Naming Services: LDAP • September 2018
剩余143页未读，继续阅读
