Hello Mark,

If long passwords and other encryption than standard crypt is enough, than you can use AIX PAM authentication with informix and you do not need to use LDAP.

Her is a link how to configure.

One more comment – in order to work you need either add user informix to „security" AIX group or allow others to read and access direktory /etc/security a file /etc/security/pwdalg.cfg

 

https://www.ibm.com/support/pages/951-952-when-using-loadable-password-algorithm-lpa-ie-ssha1-ssha256-blowfish-smb5-aix

in point 4) you can use any algorithm defined in /etc/security/pwdalg, i.e. ssha-512

 

One more comment – after reconfiguring you can you PAM dbserveralias ONLY with user and password (no equivalency). If you need trusted users for some connectivity, you should use non-pam dbserveralias (i.e. for HDR/ER)

 

Hi Mark,

PAM does not require LDAP. It's more the other way round: using an appropriate PAM module that implements LDAP, you can do LDAP authentication via PAM.

PAM uses a rather generic API definition that lets you use different PAM modules for different authentication methods. Usually, PAM is used to implement the authentication methods that are not offered otherwise, e.g. by the OS itself. Adhering to the API definition, you can even implement your own authentication method in your own PAM module, theoretically even for a retina scan or similar complicated stuff.

However, I do not not know, what PAM modules are readily available for AIX. There may be something from IBM itself, or from some third party. In the latter case it's also a question of how much you trust such a third party.

Apart from PAM and OS provided authentication methods, you can also create database internal users that have their own password inside the database instance. In the "Security" manual look for "Securing data" -> "Connection security" for more information on this topic.

We use PAM with Active Directory here and it works reasonably well. But unless you've got some sort of single-sign-on platform running (LDAP and AD are the two main ones I know about), PAM doesn't really buy you anything.