UNIX Personality Management schema extension
UNIX Personality Management requires an extension to the default Active Directory schema in order to store multiple UNIX identities for each Active Directory user and group. The UPM schema extension derives from the RFC 2307 standard for storing UNIX identity information in LDAP. It introduces new structural classes for user personalities and group personalities. You can link multiple user personalities to an Active Directory user, and multiple group personalities to an Active Directory group.
The UPM schema extension is provided in the standard LDAP Data Interchange Format (LDIF). You can use LDIF files to modify your schema using the ldifde.exe utility that is distributed by Microsoft with the Windows operating system. You must have administrative rights to extend the schema. You can find the LDIF file, qas_unix_personality_management.ldif, on the distribution media in the windows\ldif directory.
For help with running ldifde.exe, see Ldifde Command-line Reference.
Joining the domain in UNIX Personality Management mode
To join a UNIX host to the domain in UPM mode,
-
Extend the schema with the UNIX Personality Management schema extension.
-
Create a personality container.
In ADUC, right-click a container and select All Tasks > UNIX Tasks > Promote to Personality Container.
-
Join UNIX hosts to the domain in UPM mode using the new personality container.
For example, run the following vastool command to join to domain example.com using personality container ou=Unix Users,dc=example,dc=com:
vastool -u Administrator join -p "ou=Unix Users,dc=example,dc=com" example.com
When the UNIX host is joined in UPM mode, only the UNIX objects contained in the personality container are cached.
Overriding UNIX account information
You can override user account attributes on the local UNIX host. This allows you to use the identity information from Active Directory but modify individual attributes on certain hosts as needed. User overrides are specified in the /etc/opt/quest/vas/user-override configuration file. Overrides are specified as follows:
DOMAIN\sAMAccountName:<Login Name>:<UID Number>:<Primary GID Number>:<Comment (GECOS)>:<Home Directory>:<Login Shell>
DOMAIN\sAMAccountName must refer to a valid Active Directory user account. You can omit any of the UNIX account fields. If a field is not specified it will get the default value for that user. You can override every member of a group using the following syntax:
DOMAIN\sAMAccountName:::::<Home Directory>:<Login Shell>
DOMAIN\sAMAccountName must refer to a valid Active Directory group account. You can only specify the Home Directory and Login Shell attributes because all of the other attributes are user-specific. You can insert a special %s macro anywhere in the override entry to specify the user name. For example, refer to the /etc/opt/quest/vas/user-override.sample file. See also the Overriding UNIX Account Information section in the vasd man page. For information about accessing the vasd man page, see Using manual pages (man pages).
You can manage user overrides using Group Policy. For more information, see Account Override policies..
Managing UNIX group accounts
You can UNIX-enable Active Directory groups. A UNIX-enabled group has a Group Name and a GID Number. These attributes cause an Active Directory group to appear as a standard UNIX group. The group membership on UNIX is the same as the Windows group membership, but any users that are not UNIX-enabled are excluded from the group membership on the UNIX host.
