hpss_ldap_import to convert DCE authorization information into LDAP.
• Kerberos authentication and Unix authorization. In this case, the site determines on its own
how to convert DCE authentication information into Kerberos. The site will then use
hpss_unix_import to convert DCE authorization information into Unix. Depending on
environment variables, the hpss_unix_import program may import authentication information
(i.e. Create a password for the Unix user) into Unix. The site could manually reset or remove
the password from the converted Unix accounts if this is an issue after running the
hpss_unix_import program.
6.2.3.1. Authentication Mechanisms
A site may select between Unix or Kerberos authentication. Some pros and cons of each are listed
below.
Unix:
• Cross cell authentication is not supported.
• Can choose to use either system password or HPSS password file.
• Can degrade performance as the number of HPSS users increases due to sequential seeking
through password file.
• Encryption is performed using Unix encrypt function.
• HPSS servers/processes utilize Unix keytab file.
• Can use LDAP or Unix as authorization mechanism.
• The hpss_dce_export and hpss_unix_import utilities are provided to convert DCE
authentication information.
Kerberos:
• Cross cell authentication information is not converted; thus, not covered in this document.
• Using an institutional Kerberos server can complicate conversion if UID conflicts exists
between current DCE principals or groups and existing Kerberos principals or groups.
• Uses underlying Kerberos encryption algorithms.
• HPSS servers/processes utilize Kerberos keytab file.
• Requires LDAP as authorization mechanism; Unix authorization not supported.
• No utilities are provided to convert DCE information to Kerberos. Site are required to perform
the conversion from DCE on their own.
6.2.3.2. Authorization Mechanisms
A site may select between Unix or LDAP authorization. Some pros and cons of each are listed
below.
Unix:
• Can degrade performance as the number of HPSS users increases due to sequential seeking
through password file.
• Easier to setup and manage than LDAP.
HPSS Installation Guide July 2008
Release 6.2 (Revision 2.0) 183
