Group user attributes mapping (AIX)

You can use this policy to map AIX group attributes to Active Directory group attributes. This mapping works on a per-system basis. With this policy in use, adclient returns the mapped Active Directory attributes values from a LAM (Loadable Authentication Module) query of the configured AIX group attributes.

This group policy modifies the lam.attributes.group.map setting in the agent configuration file.

The syntax for the mapping configuration file is:

AIX_ATTR AD_ATTR BYPASS_CACHE

AIX_ATTR indicates AIX attribute name AD_ATTR indicates Active Directory attribute name BYPASS_CACHE is optional, by default it's not specified. If it is specified, then adclient always tries to directly get the mapped attribute from Active Directory first, instead of trying to read from the cache first.

The following AIX attributes below are not supported for group mapping: id, registry, and users.

for example: adms memberUid

The example above maps the AIX group attribute adms to the Active Directory group attribute memberUid. The Delinea LAM module would return the memberUid value for any queries that include the adms AIX group attribute. And, adclient will try to read the memberUid value first from the cache.

For more information about AIX attributes mapping syntax, see the sample file /etc/centrifydc/attributes.group.map.sample.