LDAP Client Profiles

To simplify Solaris client setup, and avoid having to reenter the same information for each and every client, create a single client profile on the directory server. This way, a single profile defines the configuration for all clients configured to use it. Any subsequent change to the profile attributes is propagated to the clients at a rate defined by the refresh interval.

These client profiles should be stored in a well-known location on the LDAP server. The root DN for the given domain must have an object class of nisDomainObject and a nisDomain attribute containing the client's domain. All profiles are located in the ou=profile container relative to this container. These profiles should be readable anonymously.

Client Profile Attributes

The following table shows the Solaris LDAP client's profile attributes, which can be set automatically when you run idsconfig. See Initializing a Client Manually and the idsconfig(1M) man page for information on how to set a client profile manually.

Table 9-2 Client Profile Attributes

Attribute	Description
`cn`	The profile name. The attribute has no default value. The value must be specified.
`preferredServerList`	The host addresses of the preferred servers is a space separated list of server addresses. (Do not use host names.) The servers in this list are tried in order before those in `defaultServerList` until a successful connection is made. This has no default value. At least one server must be specified in either `preferredServerList` or `defaultServerList`.
`defaultServerList`	The host addresses of the default servers is a space separated list of server addresses. (Do not use host names.) After the servers in `preferredServerlist` are tried, those default servers on the client's subnet are tried, followed by the remaining default servers, until a connection is made. At least one server must be specified in either `preferredServerList` or `defaultServerList`. The servers in this list are tried only after those on the preferred server list. This attribute has no default value.
`defaultSearchBase`	The DN relative to which to locate the well-known containers. There is no default for this value. However, this can be overridden for a given service by the `serviceSearchDescriptor` attribute.
`defaultSearchScope`	Defines the scope of a database search by a client. It can be overridden by the `serviceSearchDescriptor` attribute. The possible values are `one` or `sub`. The default value is a `one` level search.
`authenticationMethod`	Identifies the method of authentication used by the client. The default is none (anonymous). See Choosing Authentication Methods for more information.
`credentialLevel`	Identifies the type of credentials a client should use to authenticate. The choices are `anonymous`, `proxy`, or `self` (also known as per user). The default is `anonymous`.
`serviceSearchDescriptor`	Defines how and where a client should search for a naming database, for example, if the client should look in one or more points in the DIT. By default no SSDs are defined.
`serviceAuthenticationMethod`	Authentication method used by a client for the specified service. By default, no service authentication methods are defined. If a service does not have `serviceAuthenticationMethod` defined, it will default to the value of `authenticationMethod`.
`attributeMap`	Attribute mappings used by client. By default no `attributeMap` is defined.
`objectclassMap`	Object class mappings used by client. By default no `objectclassMap` is defined.
`searchTimeLimit`	Maximum time [in seconds] a client should allow for a search to complete before timing out. This does not affect the time the LDAP server will allow for a search to complete. The default value is `30` seconds.
`bindTimeLimit`	Maximum time in seconds a client should allow to bind with a server before timing out. Default value is `30` seconds.
`followReferrals`	Specifies whether a client should follow an LDAP referral. Possible values `TRUE` or `FALSE`. The default value is `TRUE`.
`profileTTL`	Time between refreshes of the client profile from the LDAP server by the `ldap_cachemgr`(1M). Default is `43200` seconds or 12 hours. If given a value of 0, the profile will never be refreshed.

Local Client Attributes

The following table lists the client attributes that can be set locally using ldapclient. See the ldapclient(1M) man page for more information.

Table 9-3 Local Client Attributes

Attribute	Description
`domainName`	Specifies the client's domain name (which becomes the default domain for the client machine). This attribute has no default value and must be specified.
`proxyDN`	The proxy's distinguished name. If the client machine is configured with `credentialLevel` of `proxy`, the `proxyDN` must be specified.
`proxyPassword`	The proxy's password. If the client machine is configured with `credentialLevel` of proxy, `proxyPassword` must be defined.
`certificatePath`	The directory on the local file system containing the certificate databases. If a client machine is configured with `authenticationMethod` or `serviceAuthenticationMethod` using TLS, then this attribute is used. The default value is `/var/ldap`.

Note - If the BaseDN in an SSD contains a trailing comma, it is treated as a relative value of the defaultSearchBase. The values of the defaultSearchBase are appended to the BaseDN before a search is performed.