Safeguard Authentication Services 5.0.2 - Administration Guide

Using OAT

You use OAT to change the ownership of files and directories on Unix hosts to reflect the UID and GID in Active Directory. This allows you to maintain user or group information exclusively in Active Directory.

Use one of the following ways to change file ownership:

• You can run the individual components of OAT manually as explained in Changing file ownership manually.
• You can run the interactive script, called oat, as explained in Changing file ownership using the script.

You can run OAT any time after you have installed Safeguard Authentication Services. OAT makes scenarios such as mergers, acquisitions, and business unit restructuring much simpler. If you have been using override files and mapped users, you can simplify your Safeguard Authentication Services implementation by running OAT.

OAT allows you to maintain user information in Active Directory and simplify the footprint of information required on each Unix host. To do this, set the UID (User ID) and GID (Group ID) of each file or directory on each host to that of the User ID and Group ID maintained in Active Directory. For example, suppose you have the following user information:

And in Active Directory you have:

After running OAT, the UID associated with each file and/or directory on each host is 55555, as follows:

Once you have changed the UID and GID to reflect the information now maintained in Active Directory, you can remove the /etc/passwd, /etc/shadow, and /etc/group information from each host. Safeguard Authentication Services allows proper permission handling of each file and directory.

Installing OAT

OAT is implemented as a combination of binaries and is included in the vasclnt package.

The following OAT man pages explain all the command line parameters and options:

• oat (1)
• oat_adlookup (1)
• oat_changeowner (1)
• oat_match (1)

Changing file ownership manually

OAT consists of three utilities. You run each of these utilities in order. The first two steps of the process create a file that gets passed to the next step:

1. oat_adlookup

   The first command creates the Active Directory User Information file (or the Active Directory Group Information file ) listing the Unix-enabled Active Directory users (or groups) that is passed to oat_match to create a map between Active Directory and local users or groups.

2. oat_match

   The second command creates the User map file (or the Group map file ) containing mappings between Active Directory and local users (or groups) that is passed to oat_changeowners to align file ownership.

3. oat_changeowner

   The third command changes UID and/or GID of files and directories on local Unix hosts to the UID/GID maintained in Active Directory. Before you do this step you can manually create special files to pass into oat_changeowner, the Files to Process List file or the Files to Exclude List file . Finally, oat_changeowner produces the Processed Files List file .

The /opt/quest/libexec/oat/oat_example.sh script file shows you examples of running OAT without using the interactive script. Having the ability to run the oat utilities manually gives you flexibility when changing ownership. As noted in the example in Changing file ownership using the script, OAT is not limited when hosts do not use the same naming conventions.

# /opt/quest/libexec/oat/oat_adlookup -h

Performing a cross-domain search

To perform a cross-domain search

1. Enter the following command:

   vastool -u admin -w password search -b "dc=example2,dc=com" "(objectCategory=person)" sAMAccountName > results_file

   This command performs a cross-domain search of all person objects in the example2.com domain, and puts their sAMAccountName into a new file called results_file.

2. Use the results_file for the oat_match.

   For more information about vastool search options, refer to the OAT man page.