[FASherman]

I know some of you out there are still using NIS because I've worked with you over the last few years. I make it a point to mention that some other user management system is definitely in your best interest. Even at its hight of popularity, NIS was insecure and problematic.

IBM is certainly encouraging this migration. Ideally, IBM would like you to migrate LDAP for user authentication, and this is definitely a direction that makes sense for many users. You can review the procedures for making this migration here.

However, most companies are mixed environments of Unix and Windows. As much as I hate to admit it, I find that companies have far more mature procedures and policies - such as password aging and reuse - in their windows environments than for their Unix servers. Why not take advantage of this?

You can use Microsoft Active Directory for user authentication for AIX via Kerberos. AIX 5L user authenticates against Microsoft’s Kerberos Key Distribution Center (KDC) and receives a ticket-granting ticket (TGT) upon successful authentication. User information is stored in the Microsoft Active Directory.

By default, the Active Directory schema does not have the required POSIX
attributes (such as user ID, group ID, and login shell) defined. Without these attributes, a user would be unable to log on to any UNIX client, using Active Directory. In order to integrate UNIX clients into Active Directory, Microsoft released a product called Microsoft Windows Services for UNIX (SFU), extending the Active Directory schema with object classes required to support UNIX clients.

Regardless of the direction you choose, you really should make every effort to move away from NIS, the sooner the better.