How the nss_ad Naming Service Module Retrieves Data From AD

The following section describes how the nss_ad module resolves naming service requests for the passwd, shadow, and group files by retrieving corresponding data from AD.

Retrieving passwd Information

The following syntax shows the proper form of a passwd entry:

username:password:uid:gid:gecos:home-directory:login-shell

See the passwd(4) man page for more information.

The nss_ad module retrieves passwd information from AD as follows:

• username – Field uses the value of the samAccountName AD attribute and is qualified by the domain name in which the object resides, for example, terryb@example.com.

• password – Field uses the value of x because the user password is not available in the AD object.

• uid – Field uses the Windows user's SID from the objectSID AD attribute, which is mapped to the UID by using the idmap service.

• gid – Field uses the Windows user's primary group SID, which is mapped to the GID by using the idmap service. The group SID is obtained by appending the value of the primaryGroupID AD attribute to the domain SID. For users in AD, the primaryGroupID attribute is an optional attribute, so it might not exist. If the attribute does not exist, nss_ad uses the idmap diagonal mapping facility to map the user SID from the objectSID attribute.

• gecos – Value of the CN AD attribute.

• home-directory – Value of the homeDirectory AD attribute, if a value exists. Otherwise, the field is left empty.

• login-shell – Field is left empty because there is no login shell attribute in the native AD schema.

Retrieving shadow Information

The following syntax shows the proper form of a shadow entry:

username:password:lastchg:min:max:warn:inactive:expire:flag

See the shadow(4) man page for more information.

The nss_ad module retrieves shadow information from AD as follows:

• username – Field uses the value of the samAccountName AD attribute and is qualified by the domain name in which the object resides, for example, terryb@example.com.

• password – Field uses the value of *NP* because the user password is not available in the AD object.

The rest of the shadow fields are left empty because shadow fields are irrelevant with AD and Kerberos v5.

Retrieving group Information

The following syntax shows the proper form of a group entry:

groupname:password:gid:user-list

See the group(4) for man page for more information.

The nss_ad module retrieves information from AD as follows:

• groupname – Field uses the value of the samAccountName AD attribute and is qualified by the domain name in which the object resides, for example, admins@example.

• password – Field is left empty because the Windows groups do not have passwords.

• gid – Field uses the Windows group's SID from the objectSID AD attribute, which is mapped to the GID by using the idmap service.

• user-list – Field is left empty.