
Chapter 9. Authentication in ThinLinc
In ThinLinc, this problem is solved using two programs, tl-nds-posixuser and tl-nds-posixgroup that
searches the directory for users that don’t have posixAccount among their objectclasses, and for groups
that don’t have posixGroup among their objectclasses. When it finds such a user or group, the values
required are automatically assigned. Optionally, tl-nds-posixuser can be used to assign filesystem
permissions to home directories exported from Novell Netware servers in Independent mode (see Section
10.2).
The idea is that tl-nds-posixuser and tl-nds-posixgroup are first run during deployment of the ThinLinc
installation. At this occasion, all existing users and groups are assigned the posixAccount attributes.
After deployment, tl-nds-posixuser and tl-nds-posixgroup are meant to be run from cron at regular
intervals, for example every 15 minutes. This way, new users and groups added to the directory will be
assigned the relevant attributes automatically. This means that new users will be able to log in to the
ThinLinc servers without the administrator having to take any action, after a short delay determined by
the interval between each tl-nds-posixuser invocation.
9.3.4.1. Configuration of tl-nds-posixuser and tl-nds-posixgroup
tl-nds-posixuser and tl-nds-posixgroup both need a set of configuration parameters to be able to
perform their dutys. Some of the parameters are common to the two programs, others are
command-specific. Parameters common to the two are stored under the /utils/tl-nds/ hiveconf
folder. Parameters specific to tl-nds-posixuser are stored under the /utils/tl-nds/posixuser/
hiveconf folder, and parameters specific to tl-nds-posixgroup are stored under the
/utils/tl-nds/posixgroup/ hiveconf folder.
It is a good idea to run the ThinLinc Novell Configurator as documented in Section 9.3.1. This creates
the user object needed by tl-nds-posixuser and tl-nds-posixgroup, and writes down information about the
server, user DN and password to /utils/tl-nds/.
All parameters specified in hiveconf can be overridden using command line parameters.
Table 9-1. Configuration Parameters Common to Both tl-nds-posixuser and tl-nds-posixgroup
Hiveconf parameter path Command line parameter Explanation
/utils/tl-nds/ldapuri --ldapuri The LDAP URI to connect to.
This may be either a ldap:// or
ldaps://, the latter for LDAP over
SSL.
/utils/tl-nds/binddn --binddn The DN of the object that should
be used to bind to the eDirectory.
This DN must have permissions
to change some attributes of all
relevant users in the directory.
See below for information on the
exact procedure for creating this
object.
96
Comentarios a estos manuales