Self-enrollment allows users to map their Unix account to an Active Directory account as they log in to Unix. This mapping occurs as part of the standard PAM login. Users are first prompted for their Unix password. Once authenticated to Unix, they are prompted to authenticate to Active Directory. This process happens on the first log in after you enable self-enrollment. Once the self-enrollment is complete, the user logs in with his Unix user name and Active Directory password.
To enable self-enrollment
vastool configure vas vas_auth enable-self-enrollment true
Note: All users mapped by the self-enrollment process are stored in the /etc/opt/quest/vas/automatic_mappings file.
stopsrc -s vasd startsrc -s vasd
Note: Due to library changes between the Authentication Services 4.1 and 4.2, the system may need to be rebooted before all processes load the new libraries.
When user identity information is not stored centrally within Active Directory, it is possible for Active Directory users to have Posix identity attributes automatically generated for them when interacting with Unix hosts, allowing the user to authenticate with an Active Directory password.
This is convenient in situations where you can not utilize enterprise user and group identification from Active Directory. For example, when you do not have sufficient rights to modify User identity objects, or are unable to create the Authentication Services Application Configuration object, you can configure Authentication Services to auto-generate Posix identity attributes on the Unix host for Active Directory users.
The following attributes are auto-generated:
The generated attributes are stored locally on each Unix host and remain in effect until manually removed by the system administrator.
Once a host has Posix identity attributes generated for an Active Directory user or group, they remain in effect until you manually remove them. This ensures that you take the proper steps when migrating user identities, specifically when you realign the file and directory ownerships to the new UID and GID values.
To migrate an auto-generated user to use an enterprise identity
vastool list –f user <username>