Novell LINUX ENTERPRISE SERVER 10 SP2 - INSTALLATION AND ADMINISTRATION Installation Manual page 707

36.6.1 Standard Procedure
Background knowledge of the processes acting in the background of a client machine
helps you understand how the YaST LDAP client module works. If LDAP is activated
for network authentication or the YaST module is called, the packages pam_ldap and
nss_ldap are installed and the two corresponding configuration files are adapted.
pam_ldap is the PAM module responsible for negotiation between login processes
and the LDAP directory as the source of authentication data. The dedicated module
pam_ldap.so is installed and the PAM configuration is adapted (see Example 36.11,
"pam_unix2.conf Adapted to LDAP" (page 689)).
Example 36.11 pam_unix2.conf Adapted to LDAP
auth: use_ldap
account: use_ldap
password: use_ldap
session: none
When manually configuring additional services to use LDAP, include the PAM LDAP
module in the PAM configuration file corresponding to the service in /etc/pam.d.
Configuration files already adapted to individual services can be found in /usr/
share/doc/packages/pam_ldap/pam.d/. Copy appropriate files to /etc/
pam.d.
glibc name resolution through the nsswitch mechanism is adapted to the employ-
ment of LDAP with nss_ldap. A new, adapted file nsswitch.conf is created in
/etc with the installation of this package. Find more about the workings of nsswitch
.conf in Section 30.7.1, "Configuration Files" (page 589). The following lines must
be present in nsswitch.conf for user administration and authentication with LDAP.
See Example 36.12, "Adaptations in nsswitch.conf" (page 689).
Example 36.12 Adaptations in nsswitch.conf
passwd: compat
group: compat
passwd_compat: ldap
group_compat: ldap
These lines order the resolver library of glibc first to evaluate the corresponding files
in /etc and additionally access the LDAP server as sources for authentication and
user data. Test this mechanism, for example, by reading the content of the user database
LDAP—A Directory Service 689