Chapter 9. Authentication in ThinLinc
9.3. Using Novell eDirectory with ThinLinc
9.3.1. Configuring eDirectory and ThinLinc with TLNC
Within ThinLinc, a tool called ThinLinc Novell Configurator (TLNC) helps in the task of configuring
ThinLinc to interoperate with a Novell eDirectory server. By using this tool, most of the tasks needed to
configure the eDirectory and ThinLinc servers are automated.
The Novell Configurator is available as a module in the ThinLinc Web Administration as documented in
Chapter 16.
9.3.1.1. Tasks Performed by TLNC
The ThinLinc Novell Configurator takes care of the following tasks:
• Verifying existence of the posixAccount and posixGroup objectclasses
Some older versions of eDirectory lacks the relevant LDAP schema needed for proper operation with a
ThinLinc server. If they don’t exist, they can most often be added by installing the Native File Access
for Unix product from Novell.
• Check for and remove incorrect attribute mappings
Some older versions of eDirectory, among them eDirectory on Netware 6.0, has incorrect attribute
mappings, mapping the NDS attribute UID to uidNumber, and GID to gidNumber. If they exist,
eDirectory will not function properly with a ThinLinc server.
• Create user object needed for search operations
The ThinLinc servers need to run LDAP search operations, and to be able to access the relevant
attributes, they will bind as a special user object with DN and password. The TLNC can create this
user, if it doesn’t exist.
• Give relevant permissions to the search user object
The user object used for search operations need to have access to a number of attributes. The TLNC
can modify the ACL (Access Control Lists) of the eDirectory server to allow the search user object to
read the relevant attributes. TLNC will also create the file
/opt/thinlinc/etc/ldap.conf.template that can be used as a template for the configuration
file needed for pam_ldap and nss_ldap.
• Create user object needed for tl-nds-posixuser/tl-nds-posixgroup
In most cases where ThinLinc is integrated with a eDirectory server, the tl-nds-posixuser and
tl-nds-posixgroup tools are used to add attributes to existing user and group objects in the directory to
make them usable in the ThinLinc environment. The TLNC can create the user object needed by the
tools to access eDirectory. It will also write information about this user to the relevant configuration
file.
See Section 9.3.4 for detailed information on tl-nds-posixuser and tl-nds-posixgroup.
• Give relevant permissions to user object used by tl-nds-posixuser/tl-nds-posixgroup
The user object needed by tl-nds-posixuser and tl-nds-posixgroup need to have read and write access
to a number of attributes. The TLNC can modify the ACL (Access Control Lists) of the eDirectory
server to allow the user object to read the relevant attributes.
92
Komentáře k této Příručce