configure pam_ldap in rhel7 to connect solaris ldap server

PAM -Pluggable Authentication Module

The controlling is in /etc/nsswitch.conf where the system determines against

There are many writeups on PAM

Pam is the interface/interchange to the authentication
Pum_unix uses the /etc/shadow /etc/passwd to validate the login attempt (files in nsswitch.conf)

Pam_ldap.conf often relies on an additional LDAP.conf to interact with an openldap, or other LDAP server against which it validate a user's login attempt.

Think of it as a translator.
Pam_ldap speaks LDAP
Pam_unix speaks UNIX files.

LDAP, nis, nis+ are centrally managed directories such that adding a user to the directory avails the administrator organization the ability to grant or revoke rights of a user without the need to access individual systems.

I.e. In a thirty server/system environment adding a user to the directory could grant the user access to each system, without the need as mentioned if using files where the admin would have to log into each system to add the user or remove the user depending on a scenario

Thanks for the detailed explanation. I do want to configure openldap client on rhel7 to connect solaris's ldap server.

Any steps/article?

Is openldap setup on Solaris, or it configured using directory one ..


ldapcluent deals with joining ..
System-config-auth
Where you can configure the LDAP tie in..
You may gave depending on your setup authorize this client to query the LDAP ...

Much depends on the environment.

ldap server running on solaris without tls.

Tried to setup openldap on rhel7 by following https://suresh-chandra.blogspot.in/2013/08/configuring-openldap-serverclient-on.html?showComment=1521678467727#c1305532625055249848

But, I see, ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)  while adding user with ldapadd. I couldn't see slapd running on my box. I ended up with lot of issues. Can you throw some light how to configure ldap server and authenticate with ldap users by using pam. (pam_ldap)

You do not need to setup openldap on the rhel, it is a client and need only connect and query the one running on Solaris unless you want to setup the rhel as a replica...

Before there was a system-config-authentication that configured the system for different authentication methods.
Often when the system is installed, the selection of directory, LDAP goes through collecting information ....

Please post the output from
rpm -qa |egrep -i '(ldap|system|auth)'

Tried with system-config_authentication. Expecting tls certificate. But, our solaris ldap server doesn't have tls certificate.

That's why, I am trying to configure ldap server on my own.

output:

basesystem-10.0-7.el7.centos.noarch
openldap-2.4.44-5.el7.x86_64
system-config-printer-1.4.1-19.el7.x86_64
openldap-devel-2.4.44-5.el7.x86_64
xorg-x11-xauth-1.0.9-1.el7.x86_64
firewalld-filesystem-0.4.4.4-6.el7.noarch
vim-filesystem-7.4.160-2.el7.x86_64
color-filesystem-1-13.el7.noarch
gnome-system-monitor-3.22.2-2.el7.x86_64
filesystem-3.2-21.el7.x86_64
mesa-filesystem-17.0.1-6.20170307.el7.x86_64
authconfig-6.2.8-30.el7.x86_64
systemd-python-219-42.el7_4.10.x86_64
systemtap-devel-3.1-5.el7_4.x86_64
systemtap-3.1-5.el7_4.x86_64
telepathy-filesystem-0.0.2-6.el7.noarch
mozilla-filesystem-1.9-11.el7.x86_64
liboauth-0.9.7-4.el7.x86_64
systemd-sysv-219-42.el7_4.10.x86_64
systemtap-client-3.1-5.el7_4.x86_64
fontpackages-filesystem-1.44-8.el7.noarch
control-center-filesystem-3.22.2-5.el7.x86_64
cups-filesystem-1.6.3-29.el7.noarch
openldap-servers-2.4.44-5.el7.x86_64
systemd-libs-219-42.el7_4.10.x86_64
system-config-printer-udev-1.4.1-19.el7.x86_64
openldap-servers-sql-2.4.44-5.el7.x86_64
bind-dyndb-ldap-11.1-4.el7.x86_64
libreport-filesystem-2.1.11-38.el7.centos.x86_64
boost-system-1.53.0-27.el7.x86_64
systemtap-runtime-3.1-5.el7_4.x86_64
system-config-printer-libs-1.4.1-19.el7.noarch
emacs-filesystem-24.3-20.el7_4.noarch
plymouth-system-theme-0.8.9-0.28.20140113.el7.centos.x86_64
openldap-clients-2.4.44-5.el7.x86_64
gnome-system-log-3.9.90-3.el7.x86_64
systemd-219-42.el7_4.10.x86_64
nss-pam-ldapd-0.8.13-8.el7.x86_64
compat-openldap-2.3.43-5.el7.x86_64

have not used it recently, but I think you have the option to specify without TLS/secure connection.

See if the below reference helps.

Usually, there is an /etc/ldap.conf file...

using the system-config-authentication should allow you either a secure/not secure connection to the ldap server...'


https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/

https://www.tecmint.com/setup-ldap-server-and-configure-client-authentication/

The item of interest from the second is:
authconfig --enableldap --enableldapauth --ldapserver=your_Solaris_server_name --ldapbasedn="dc=mydomain,dc=com" --enablemkhomedir --update