pam_ldap

If you run Solaris or Linux servers and workstations, you'll find that the pam_ldap module is an essential piece of software. It enables authentication against LDAP directories, as well as password changes in the directory. The Pluggable Authentication Module API defined in OSF DCE RFC 86.0 is used to achieve this, and you can use transport layer security (such as SSL or TLS) to encrypt transactions between the workstation and LDAP server. This provides strongly authenticated sign-on.

Another key feature of pam_ldap is its support for SASL interactive authentication. This enables you to authenticate strongly without the overhead of SSL/TLS. You'll also find that pam_ldap shares configuration information with the nss_ldap module, which is convenient.

For finding LDAP servers, pam_ldap supports the PADL NIS/LDAP Gateway locator. It also supports Netscape and IETF password policies, as well as host- and group-based logon authorization. If these aren't enough, you'll be pleased to know that pam_ldap works with a variety of systems, including AIX 5L, FreeBSD 3.x and above, HP-UX 11i, Linux, and Solaris 2.6 and above.

To use pam_ldap, you'll need an LDAP client library in addition to the module itself. Optionally, you can use a SASL library that's compatible with the Cyrus SASL API. Overall, pam_ldap is a great choice if you need LDAP authentication on your Solaris or Linux system.