Hello!
I work on rolling Grid services into production at Berkeley Lab, and
have been using OpenLDAP based tools for a while now (mostly the MDS
service in Globus).
Recently we've started a project to setup central authentication for
several different computer clusters. The problem I'm looking into is how
to setup the schemas so that "out of the box" PAM LDAP modules can all
go to a central server for authentication information.
We'd like to have information like usernames, uids, GECOS and password
hashes common across all systems. But home directory, path to shells and
default GID's will be different.
Looking at the man pages, it seems the only way to make this work would
be to either have each cluster go against their own tree, and then
manually sync up the common information, or else setup a SQL backend
that serves up a view that joins the common information with the cluster
specific information.
Can anyone suggest another, less complex approach to dealing with this?