Quick notes for using nss_ldap on AIX
=====================================

1. Introduction
---------------

The C library on AIX includes the IRS library which can also found in the
BIND 8.x distribution. Of course, IBM did some things The Other Way(tm)...
You can alo find related documentation at:
  <URI:http://www.padl.com/Articles/nss_ldaponAIX.html>

2. Compilation
--------------

I'm assuming you have successfully installed OpenLDAP 2.x or one of the
Netscape LDAP client libraries. I haven't tested it with IBM's LDAP
libraries. 

I'm using AIX 4.3.3. It may work with 4.[12]. It won't work with 3.x.
It is going to work on 5.x.

You need to ensure that bos.adt.syscalls has been installed for -lsys
and -lcsys to work as the /lib/syscalls.exp file (this is found
on the Kernel Extensions developer kit). [Kyle_Chapman@G1.com]

Run "configure" and "make" as usual. As of nss_ldap-196, it is no
longer necessary to specify --enable-proxy-auth if you want to use
the AIX authentication functionality; it is enabled by default.

The /etc/ldap.conf is already used by the LDAP client from
IBM SecureWay, so use

  --with-ldap-conf-file=/etc/nss_ldap.conf

to avoid confusion.  If everything went OK, you will get two
objects: nss_ldap.so and NSS_LDAP.

3. Installation
---------------

Copy nss_ldap.so to /usr/lib/netsvc/dynload (create the directory if it does
not exist), and copy NSS_LDAP to /usr/lib/security. ("make install" will
do this for you.)

4. Configuration
----------------

Edit /etc/irs.conf as you like (create it if it does not exist). "man
irs.conf" tells everything you need. As you would guess, you have to use the
"nss_ldap" mechanism name to use nss_ldap. This lets you access host,
network, service, and protocol information using LDAP (well, you can also
configure netgroups here, but when I'm writing this, nss_ldap does not have
netgroup support).

Due to the missing netgroup support, you will get lots of "dlsym of symbol:
ng_pvtinit failed: Function not implemented (ng_pvtinit)" in the system
logs. That's ugly, but harmless.

Now, the interesting part: users and groups. Have I said that IBM did it The
Other Way(tm)? Ok, add the following stanza to /lib/security/methods.cfg:

LDAP:
	program = /usr/lib/security/NSS_LDAP

If you are running AIX version which is less than 4.3.3 you will have
to add the stanza to /etc/security/login.cfg.  In case of version
4.3.3 you will have to add the same stanza to both files. Make sure
you comment out existing references to LDAP, which are for IBM's
SecureWay implementation.

Use chuser(8) to edit /etc/security/user. Change the "SYSTEM"
attribute of the "default" entry to "compat OR LDAP", i.e.:

# chuser SYSTEM="compat or LDAP" default

if you want to use the LDAP authentication system wide.
Alternatively, you can enable it on a per-user basis:

# chuser SYSTEM="compat or LDAP" username

After that you should be able to use getpwnam() and friends to get the
information from the LDAP server.  If you want to allow users to
change their passwords using the standard passwd(1) command, you will
have to change the registry attribute as well:

# chuser registry=LDAP username

(This is pointless right now as there is no support for password
changing in nss_ldap.)

NB:  The registry attribute is used to fetch/modify all the other user
attributes which are not supported by the LDAP.  In particular the
chuser(8) will fail to operate properly.  However, it is possible to
use the "-R" option to specify the registry on which the command
should operate.  For example, to change back to the normal files based
authentication and identification:

# chuser -R files SYSTEM=compat registry=files default

NB:  Users should exist in the /etc/passwd file.  That doesn't seem to
be necessary, but many strange things can happen depending on the AIX
version running.  YMMV.

5. What's missing
-----------------

The provided NSS_LDAP authentication module supports the identification
and authentication interfaces. There is, however, no support for
modifying user/group attributes (which means you won't be able to use
the "chuser" command etc. to alter user/group attributes; you have to
make all modifications directly via LDAP).

Enjoy.

Gabor Gombas <gombasg@inf.elte.hu>
Luke Howard <dev@padl.com>
Dejan Muhamedagic <dejan.muhamedagic@at.ibm.com>