Solaris as FreeIPA (IdM) client

The IPA team provides some basic configuration for non-Linux systems, like Solaris. The following instructions worked at one time and provide a basic roadmap on how to configure Solaris to authenticate against an IPA server. For additional information and support it's probably wise to contact an operating system vendor.

Note: even DNS name resolution works well for Solaris 10/11, it has been observed that LDAP servers have to be added to /etc/hosts, otherwise they cannot be contacted from Solaris, showing the error "Can't connect to the LDAP server - Unknown error"

------ Solaris 11

IdM Server

The IdM and its 389-ds already comes with the schema that supports profile for LDAP Based Agents, like Solaris.
The domain here is kompanija.com so the schema file is /etc/dirsrv/slapd-KOMPANIJA-COM/schema/15rfc4876.ldif
This can be confirmed with query from LDAP client.

root@sol-x86:/# ldapsearch -h freeipa-server -b "dc=kompanija,dc=com" -s sub "ou=profile" 
version: 1
dn: ou=profile,dc=kompanija,dc=com
objectClass: top
objectClass: organizationalUnit
ou: profiles
ou: profile

root@sol-x86:/# ldapsearch -h freeipa-server -b "dc=kompanija,dc=com" -s sub "objectclass=DUAConfigProfile"
version: 1
dn: cn=default,ou=profile,dc=kompanija,dc=com
defaultServerList: freeipa-server.kompanija.com
defaultSearchBase: dc=us,dc=oracle,dc=com
objectClass: top
objectClass: DUAConfigProfile
serviceSearchDescriptor: group:cn=groups,cn=compat,dc=kompanija,dc=com
serviceSearchDescriptor: passwd:cn=users,cn=accounts,dc=kompanija,dc=com
searchTimeLimit: 15
followReferrals: TRUE
objectclassMap: shadow:shadowAccount=posixAccount
bindTimeLimit: 5
authenticationMethod: none
cn: default

Host configuration

No work is needed on IdM server in regard to host configuration.

User configuration

It has been observed that a user cannot login using SSH public key. Some more work is needed here. A user can login using a password.

Client

NTP

The /etc/inet/ntp.conf file should read:

root@sol-x86:/# cat /etc/inet/ntp.conf
disable auth
server 10.x.x.x
driftfile /var/ntp/ntp.drift
statsdir /var/ntp/ntpstats/
filegen peerstats file peerstats type day enable
filegen loopstats file loopstats type day enable

Start NTP service and enable logging

root@sol-x86:/# svcadm enable ntp
root@sol-x86:/# svccfg -s svc:/network/ntp:default setprop config/verbose_logging = true

root@sol-x86:/# svcadm restart svc:/network/ntp:default

root@sol-x86:/# svcprop -p config/verbose_logging svc:/network/ntp:default
true

root@sol-x86:/# ntpq -p
 remote    refid st t when poll reach   delay   offset  jitter
===============================================================
*ntpserver    3 u   12   64    1    0.198   -3.978   0.000

DNS

The /etc/resolv.conf file should read:

search  kompanija.com
nameserver      10.x.x.x

The edit is done by editing service network/dns/client

# svccfg -s svc:/network/dns/client
svc:/network/dns/client> setprop config/domain = astring: kompanija.com
svc:/network/dns/client> setprop config/search = astring: "kompanija.com"
svc:/network/dns/client> setprop config/nameserver = (10.x.x.x 10.z.z.z)

# svcadm refresh svc:/network/dns/client
# svcadm restart svc:/network/dns/client

NSS

The /etc/nsswitch.conf file needs lines:

passwd: files ldap [NOTFOUND=return]
group:  files ldap [NOTFOUND=return]

The edit is done by editing service name-service/switch

# svccfg -s svc:/system/name-service/switch
svc:/system/name-service/switch> setprop config/password = astring: "files ldap [NOTFOUND=return]"
svc:/system/name-service/switch> setprop config/group = astring: "files ldap [NOTFOUND=return]"
svc:/system/name-service/switch> listprop

# svcadm refresh svc:/system/name-service/switch
# svcadm restart svc:/system/name-service/switch
# svccfg -s svc:/system/name-service/switch listprop | grep ldap
config/password                astring     "files ldap [NOTFOUND=return]"
config/group                   astring     "files ldap [NOTFOUND=return]"

PAM

Configure to use PAM Kerberos first

# cat /etc/pam.d/login
auth    requisite       pam_authtok_get.so.1
auth    sufficient      pam_krb5.so.1
auth    required        pam_dhkeys.so.1
auth    required        pam_unix_cred.so.1
auth    required        pam_unix_auth.so.1 use_first_pass
auth    required        pam_dial_auth.so.1

Kerberos client

The file /etc/krb5/krb5.conf should read:

[libdefaults]
default_realm = KOMPANIJA.COM
verify_ap_req_nofail = false
[realms]
KOMPANIJA.COM = {
kdc = freeipa-server.kompanija.com:88
admin_server = freeipa-server.kompanija.com:749
}
[domain_realm]
us.oracle.com = KOMPANIJA.COM
.us.oracle.com = KOMPANIJA.COM
[logging]
default = FILE:/var/krb5/kdc.log
kdc = FILE:/var/krb5/kdc.log
kdc_rotate = {
 period = 1d
 version = 10
}
[appdefaults]
kinit = {
renewable = true
forwardable= true
}

LDAP client

Initiate LDAP client.

root@sol-x86:/# ldapclient init freeipa-server.kompanija.com
System successfully configured

# ldapclient list
NS_LDAP_FILE_VERSION= 2.0
NS_LDAP_SERVERS= freeipa-server.kompanija.com
NS_LDAP_SEARCH_BASEDN= dc=kompanija,dc=com
NS_LDAP_AUTH= none
NS_LDAP_SEARCH_REF= TRUE
NS_LDAP_SEARCH_TIME= 15
NS_LDAP_CACHETTL= 43200
NS_LDAP_PROFILE= default
NS_LDAP_SERVICE_SEARCH_DESC= group:cn=groups,cn=compat,dc=kompanija,dc=com
NS_LDAP_SERVICE_SEARCH_DESC= passwd:cn=users,cn=accounts,dc=kompanija,dc=com
NS_LDAP_BIND_TIME= 5
NS_LDAP_OBJECTCLASSMAP= shadow:shadowAccount=posixAccount

If there is error "Can not find the nisDomainObject for domain" use this command to setup NIS domain:

root@sol-x86:/# domainname kompanija.com

Make sure there is the file /etc/defaultdomain that reads kompanija.com
Restart Ldap client if needed

root@sol-x86:/#  svcadm restart ldap/client

Verification

SSH with FreeIPA account

login as: zarko1
Using keyboard-interactive authentication.
Password:
Using keyboard-interactive authentication.
Your Kerberos account/password will expire in 89 days.
Last login: Wed Jul 13 14:20:44 2016 from some-box
Oracle Corporation      SunOS 5.11      11.3    September 2015

zarko1@sol-x86:/$ klist
Ticket cache: FILE:/tmp/krb5cc_1377600004
Default principal: zarko1@KOMPANIJA.COM
Valid starting               Expires               Service principal
13/07/2016 14:21  14/07/2016 14:21  krbtgt/KOMPANIJA.COM@KOMPANIJA.COM
        renew until 20/07/2016 14:21

It may happen that for a newly created user, a password need to be reset on the IdM server in order for user to SSH to Solaris.
Also user can't SSH using ssh key, more work is needed here.

------ Solaris 10