389 Directory Server(LDAP) with Automount
389 Directory Server(LDAP) with Automount
I’m very pleased to announce this blog page. After quite a lot of troublshooting, inaccurate, incomplete, and outdated documentation, I was finally able to get this working, and wanted to get this out to the community. As mentioned above, this is not a feature that’s widely deployed, likely due to the scarce documentation.
Understanding present environment:
In most UNIX environments you have the standalone configuration in auto.master, that maps /home/ldap (or maybee just home for your environment) we do /home/ldap that way we can differentiate local/ldap users. The auto.master relays to auto.home wich in turn mounts our DNS cname “filer1:/home/ldap/&” to mount whatever user is requesting their directory be mounted.
/etc/auto.master
/home/ldap /etc/auto.home
and
* -fstype=nfs,rw,bg,intr,soft filer1:/home/ldap/&
Let’s get Started.
Server configuration:
# First create the container for autofs configs.
dn: ou=automount,dc=yourdomain,dc=local
ou: automount
objectClass: top
objectClass: organizationalUnit
description: Automount maps
# Next create the auto.master map container.
dn: ou=auto.master,ou=automount,dc=yourdomain,dc=local
ou: auto.master
objectClass: top
objectClass: automountMap
# Create the /home/ldap mountpoint.
dn: cn=/home/ldap,ou=auto.master,ou=automount,dc=yourdomain,dc=local
cn: /home/ldap
objectClass: top
objectClass: automount
automountInformation: ldap:ou=auto.home,ou=automount,dc=yourdomain,dc=local
# Create the auto.home map container.
dn: ou=auto.home,ou=automount,dc=yourdomain,dc=local
ou: auto.home
objectClass: top
objectClass: automountMap
# Create the home value for the auto.home map.
dn: cn=*,ou=auto.home,ou=automount,dc=yourdomain,dc=local
objectClass: top
objectClass: automount
cn: *
automountInformation: -fstype=nfs,rw,bg,intr,soft filer1:/home/ldap/&
save these into a file called auto.master, and add the definitions to LDAP(389) using ldapadd
ldapadd -D “uid=admin,ou=Administrators,ou=TopologyManagement,o=NetscapeRoot” -h 127.0.0.1 -W -f auto.mount
Client Configuration:
PAM/NSCD/NSLCD Method:
1. remove/disable default settings
comment out any entries in /etc/auto.master
2. edit nsswitch.conf
vi /etc/nsswitch.conf
automount: ldap
3. edit /etc/sysconfig/autofs
vi /etc/sysconfig/autofs
MAP_OBJECT_CLASS=”automountMap”
ENTRY_OBJECT_CLASS=”automount”
MAP_ATTRIBUTE=”ou”
ENTRY_ATTRIBUTE=”cn”
VALUE_ATTRIBUTE=”automountInformation”
4. configure /etc/autofs_ldap_auth.conf
vi /etc/autofs_ldap_auth.conf
<autofs_ldap_sasl_conf
usetls=”yes”
tlsrequired=”no”
authrequired=”simple”
user=”uid=ldapauth,cn=config”
secret=”SomeAuthPassword”
/>
5. Test:
automount -m
[root@automount2 ~]# automount -m
Mount point: /home/ldap
source(s):
type: ldap
map: ldap:ou=auto.home,ou=automount,dc=yourdomain,dc=local
* | -fstype=nfs,rw,bg,intr,soft filer1:/home/ldap/&
SSSD_Client:
1. Configure SSSD:
in “domains” section
autofs_provider = ldap
ldap_autofs_search_base = ou=automount,dc=yourdomain,dc=local
2. edit nsswitch.conf
vi /etc/nsswitch.conf
automount: ldap files
3. edit /etc/sysconfig/autofs
vi /etc/sysconfig/autofs
MAP_OBJECT_CLASS=”automountMap”
ENTRY_OBJECT_CLASS=”automount”
MAP_ATTRIBUTE=”ou”
ENTRY_ATTRIBUTE=”cn”
VALUE_ATTRIBUTE=”automountInformation”
4. configure /etc/autofs_ldap_auth.conf
vi /etc/autofs_ldap_auth.conf
<autofs_ldap_sasl_conf
usetls=”yes”
tlsrequired=”no”
authrequired=”simple”
user=”uid=SomeAuthID,cn=config”
secret=”SomePassword”
5. Test:
automount -m
[root@automount2 ~]# automount -m
autofs dump map information
===========================
global options: none configured
Mount point: /home/ldap
source(s):
type: ldap
map: ldap:ou=auto.home,ou=automount,dc=yourdomain,dc=local
* | -fstype=nfs,rw,bg,intr,soft filer1:/home/ldap/&
That’s it! You should now be able to su as an LDAP user, and have your home directory mounted.