[Info-vax] LDAP

[Stephen Hoffman]

On 2020-10-07 23:14:17 +0000, Jan-Erik Søderholm said:

> I have been asked if we can use LDAP against the corporate AD systems 
> to authenticate our user logins to our OpenVMS system.
> 
> Currently on VSI/Alpha.

I was last working with this with HPE OpenVMS Alpha V8.4 with 
then-current now-mid-level patches.

> Anyone that have looked and/or tested these LDAP parts on Alpha?

In the configuration I was working with, OpenVMS was authenticating to 
an LDAP server based on OpenLDAP / Apple Open Directory, and it it 
worked.

> And if so, any thoughts, findings or something else worth to report?

The documentation and diagnostics and UI are all weak, but once you get 
through the configuration and setup morass, it does work.

There was some documentation buried within the HPE LDAP LOGINOUT kit 
that was helpful.

You'll probably want to provision a test configuration, as most places 
aren't fond of opening up LDAP for testing.

VSI (thankfully, finally) integrated the LDAP LOGINOUT support into the 
base distro, so no separate kit, so I don't know what happened with 
that doc.

There have been Boot Camp presentations on this topic which might be 
helpful if you can find those.

> How does it work with a mixed LDAP/local password verification?

The OpenVMS environment is always mixed, with passwords mirrored 
between LDAP and local storage in SYSUAF.

-- 
Pure Personal Opinion | HoffmanLabs LLC