Safeguard Authentication Services 5.0.2 - Administration Guide

Joining the domain in Unix Personality Management mode

To join a Unix host to the domain in UPM mode,

1. Extend the schema with the Unix Personality Management schema extension.
2. Create a personality container.

   In ADUC, right-click a container and select All Tasks | Unix Tasks | Promote to Personality Container.

3. Join Unix hosts to the domain in UPM mode using the new personality container.

For example, run the following vastool command to join to domain example.com using personality container ou=Unix Users,dc=example,dc=com:

vastool -u Administrator join -p "ou=Unix Users,dc=example,dc=com" example.com

When the Unix host is joined in UPM mode, only the Unix objects contained in the personality container are cached.

Overriding Unix account information

You can override user account attributes on the local Unix host. This allows you to use the identity information from Active Directory but modify individual attributes on certain hosts as needed. User overrides are specified in the /etc/opt/quest/vas/user-override configuration file. Overrides are specified as follows:

DOMAIN\sAMAccountName:<Login Name>:<UID Number>:<Primary GID Number>:<Comment (GECOS)>:<Home Directory>:<Login Shell>

DOMAIN\sAMAccountName must refer to a valid Active Directory user account. You can omit any of the Unix account fields. If a field is not specified it will get the default value for that user. You can override every member of a group using the following syntax:

DOMAIN\sAMAccountName:::::<Home Directory>:<Login Shell>

DOMAIN\sAMAccountName must refer to a valid Active Directory group account. You can only specify the Home Directory and Login Shell attributes because all of the other attributes are user-specific. You can insert a special %s macro anywhere in the override entry to specify the user name. For example, refer to the /etc/opt/quest/vas/user-override.sample file. See also the Overriding Unix Account Information section in the vasd man page. See to Using manual pages (man pages) for information about accessing the vasd man page.

You can manage user overrides using Group Policy. For more information, see Account Override policies.

Managing Unix group accounts

You can Unix-enable Active Directory groups. A Unix-enabled group has a Group Name and a GID Number. These attributes cause an Active Directory group to appear as a standard Unix group. The group membership on Unix is the same as the Windows group membership, but any users that are not Unix-enabled are excluded from the group membership on the Unix host.

Nested group support

Safeguard Authentication Services supports the Active Directory nested group concept, where groups can be added as members of other groups such that users in the child group are members of the parent group as well.

Nested group information is provided in the Kerberos ticket. This information is cached when the user logs in. Any time a user performs a non-Kerberos login (such as when using SSH keys), nested group information is not available. In these situations, you can ensure that group memberships include nested groups by enabling the groups-for-user-update option in vas.conf. See vas.conf man page for more details. This will produce more LDAP traffic, but group memberships will remain up-to-date. Unless this option is enabled, nested group memberships are only updated when a user logs in.