Server for NIS: users outside of User container will not authenticate on client

after spending many hours trying server nis work correctly, experienced problem user accounts existed in ad not authenticate correctly in client.  upon further investigation, found the migration wizard stored new users in user container default.  on haunch moved user account custom ou user container, , sure enough, authenticated correctly!

question: know how configure server nis use ous containing nis objects in it's equivalent passwd file mapping unix client authenticates against?

platform info: ad on windows server 2003 r2 x32, nis client on solaris 10 5/08

when add unix attributes existing ad user account, server nis immediately includes user in its nis maps.  evidenced using "ypcat passwd" on client.  output in fact show modified user in list, albeit default password synchornization key user's encrypted passwd: "abcd!efgh12345$65890."  change once reset user's passwd in ad (you can use previous password again), won't see update unless use "ypmatch username passwd."

so works great... when you're on the client and try su user, fails authenticate login.  in fact, if su super user account , try "whoami" command, it returns "whoami: no login associated uid xxxxx" xxxx user's uid. 

this happens, turns out, because user in question not contained in default user container.  problem put users in custom ous organizational puropses , enforce different group policies.  moving user account user container not valid option.

thanks helpful feedback.

thanks ace, @ other forums.  however, not unix issue.  windows server issue, since server nis windows server service.

---

trey taylor

i'm afraid not solve problem.  user mapping great , fantastic nfs.  can map windows accounts unix accounts, regardless of container or ou windows accounts located.  provides necessary handshake when user attempts access nfs share, , works seemlessy.

however, not address issues of "single sign-on," trying utilizing active directory nis master.  whatever reason, server nis--the service that makes possible ad nis master--is authenticating users accounts located in users container.  if ever find solution, post here; but, is, appears have turn alternative solution, ldap.

---

trey taylor

trey,

yes, understand it's windows issue. that's why suggested contacting microsoft support.:
http://support.microsoft.com/default.aspx?scid=fh;en-us;phonenumbers 

.

---

ace fekay
mvp, mct, mcitp enterprise administrator, mcts windows 2008 & exchange 2007 & exchange 2010, exchange 2010 enterprise administrator, mcse & mcsa 2003/2000, mcsa messaging 2003
microsoft certified trainer
microsoft mvp - directory services
complete list of technical blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php

this posting provided as-is no warranties or guarantees , confers no rights.

Windows Server  >  Directory Services