{"id":7702,"date":"2013-05-17T15:38:27","date_gmt":"2013-05-17T20:38:27","guid":{"rendered":"http:\/\/jianmingli.com\/wp\/?p=7702"},"modified":"2013-07-24T10:12:29","modified_gmt":"2013-07-24T15:12:29","slug":"solaris-authentication-with-active-directory","status":"publish","type":"post","link":"https:\/\/jianmingli.com\/wp\/?p=7702","title":{"rendered":"Solaris Authentication with Active Directory"},"content":{"rendered":"
\n

Contents<\/h2>\n
    \n\t
  1. \n\t\tEnvironment<\/a>\n\t<\/li>\n\t
  2. \n\t\tPrepare Windows Server<\/a>\n\t\t
      \n\t\t\t
    1. \n\t\t\t\tInstall Identity Management for Unix<\/a>\n\t\t\t<\/li>\n\t\t\t
    2. \n\t\t\t\tTuning AD<\/a>\n\t\t\t<\/li>\n\t\t\t
    3. \n\t\t\t\tProvision a Unix User in AD<\/a>\n\t\t\t<\/li>\n\t\t\t
    4. \n\t\t\t\tConfigure DNS<\/a>\n\t\t\t<\/li>\n\t\t<\/ol>\n\t
    5. \n\t\tSynchronize Solaris Time to Windows Server NTP Service<\/a>\n\t\t
        \n\t\t\t
      1. \n\t\t\t\tSetup Windows 2008 R2 NTP Server<\/a>\n\t\t\t<\/li>\n\t\t\t
      2. \n\t\t\t\tSetup Solaris NTP Client<\/a>\n\t\t\t<\/li>\n\t\t<\/ol>\n\t
      3. \n\t\tConfigure Kerberos with adjoin Script<\/a>\n\t<\/li>\n\t
      4. \n\t\tInitialize Solaris LDAP Client<\/a>\n\t\t
          \n\t\t\t
        1. \n\t\t\t\tPrerequisites<\/a>\n\t\t\t<\/li>\n\t\t\t
        2. \n\t\t\t\tInitialize with ldapclient<\/a>\n\t\t\t<\/li>\n\t\t\t
        3. \n\t\t\t\tUsing Naming Service Switch and PAM<\/a>\n\t\t\t<\/li>\n\t\t\t
        4. \n\t\t\t\tTest Password Management<\/a>\n\t\t\t<\/li>\n\t\t<\/ol>\n\t
        5. \n\t\tUseful Tools<\/a>\n\t\t
            \n\t\t\t
          1. \n\t\t\t\tExport ldif File from AD: ldifde<\/a>\n\t\t\t<\/li>\n\t\t\t
          2. \n\t\t\t\tldapadd<\/a>\n\t\t\t<\/li>\n\t\t\t
          3. \n\t\t\t\tldapmodify<\/a>\n\t\t\t<\/li>\n\t\t<\/ol>\n\t
          4. \n\t\tReferences<\/a>\n\t<\/li>\n<\/ol>\n<\/ol>\n<\/div>\n
             <\/div>\n

            Environment<\/h2><\/span>\n

            * Windows Server 2008R2 Enterprise Edition
            \n* Solaris 10 x64 u11<\/p>\n

            Prepare Windows Server<\/h2><\/span>\n

            * See this post<\/a> on how to install Windows Server 2008R2 on ESXi 5.1.<\/p>\n

            Install Identity Management for Unix<\/h3><\/span>\n

            * Login Windows Server 2008R2.
            \n* Open Start > Administrative Tools > Server Manager<\/em>
            \n* Right click Server Manager > Roles > Active Directory Domain Service<\/em> and select Add Role Services<\/em>
            \n* Select Server for Network Information Services<\/em><\/p>\n

            \"\"<\/a><\/h6><\/span>\n

            * Click Next <\/em>and then Install<\/em>.
            \n* Restart server.
            \n* Open Start > Administrative Tools > Active Directory Users and Computers<\/em>. Check the presence of UNIX Attributes:<\/p>\n

            \"\"<\/a><\/h6><\/span>\n

            Tuning AD<\/h3><\/span>\n

            * These Solaris client attributes need to be tuned:
            \n– uid
            \n– uidnumber
            \n– gid
            \n– gidnumber
            \n* Register Schema Management Snap-In<\/p>\n

            \r\nregsvr32 schmmgmt\r\n<\/pre>\n
            * Open mmc console<\/p>\n
            \r\nmmc \/a\r\n<\/pre>\n
            * Add Active Directory Schema snap-in:
            \nFile > Add\/Remove snap-in… > Active Directory Schema<\/em>
            \n* Select Console Root > Active Directory Schema > Attributes<\/em>
            \n* Index attributes: uid, uidnumber, gid, gidnumber<\/em><\/p>\n
            \"\"<\/a><\/h6><\/span>\n
            Provision a Unix User in AD<\/h3><\/span>\n
            * Add a new user named johndoe<\/strong> to AD:<\/p>\n
            \"\"<\/a><\/h6><\/span>\n
            \"\"<\/a><\/h6><\/span>\n
            \"\"<\/a><\/h6><\/span>\n
            * With Unix attributes<\/p>\n
            \"\"<\/a><\/h6><\/span>\n
            Configure DNS<\/h3><\/span>\n
            * Create a forward (A) and reverse (PTR) DNS record for Solaris client:<\/p>\n
            \"\"<\/a><\/h6><\/span>\n
            * Create a reverse (PTR) DNS record for AD server:<\/p>\n
            \"\"<\/a><\/h6><\/span>\n
            * Check that both forward and reverse lookup worked:<\/p>\n
            \"\"<\/a><\/h6><\/span>\n
            Synchronize Solaris Time to Windows Server NTP Service<\/h2><\/span>\n
            Setup Windows 2008 R2 NTP Server<\/h3><\/span>\n
            * Set HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\Config\\AnnounceFlags<\/strong> to 10<\/strong><\/p>\n
            <\/h6><\/span>\n
            * Set HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\TimeProviders\\NtpServer\\Enabled<\/strong> to 1<\/strong>
            \n* Restart w32time<\/em><\/p>\n
            \r\nnet stop w32time && net start w32time\r\n<\/pre>\n
            Setup Solaris NTP Client<\/h3><\/span>\n
            \r\ncp \/etc\/inet\/ntp.client \/etc\/inet\/ntp.conf\r\ntouch \/var\/ntp\/ntp.drift\r\nvi \/etc\/inet\/ntp.conf\r\n# With content:\r\nserver Exchangedc1\r\ndriftfile \/var\/ntp\/ntp.drift\r\nmulticastclient 224.0.1.1\r\n<\/pre>\n
            * Refresh daemon NTP<\/p>\n
            \r\nsvcadm enable svc:\/network\/ntp\r\nsvcadm refresh svc:\/network\/ntp\r\nsvcadm restart svc:\/network\/ntp\r\n<\/pre>\n
            * check status to make it’s status is online<\/p>\n
            \r\nsvcs ntp\r\nSTATE          STIME    FMRI\r\nonline         Jul_21   svc:\/network\/ntp:default\r\n<\/pre>\n
            Configure Kerberos with adjoin Script<\/h2><\/span>\n
            * Download adjoin-s10u5.ta\u00adr.gz<\/em>, for example, from here<\/a>
            \n* Copy adjoin-s10u5.ta\u00adr.gz<\/em> to sol10x64vm1<\/em> and unzip it:<\/p>\n
            \r\ngunzip -c adjoin-s10u5.ta\u00adr.gz |tar xvf -\r\n<\/pre>\n
            * Check resolv.conf<\/em> and nsswitch.dns<\/em><\/p>\n
            \"\"<\/a><\/h6><\/span>\n
            * Run adjoin -f<\/em><\/p>\n
            \"\"<\/a><\/h6><\/span>\n
            * Verify setup with ldapsearch<\/p>\n
            \r\nldapsearch -h Exchangedc1 -o mech=gssapi -o authzid='' -b \"cn=sol10x64vm1,cn=computers,dc=exchange,dc=local\" -s base \"\" cn\r\nversion: 1\r\ndn: cn=sol10x64vm1,cn=computers,dc=exchange,dc=local\r\ncn: SOL10X64VM1\r\n<\/pre>\n
            * List Kerberos ticket cache:<\/p>\n
            \r\nklist\r\nTicket cache: FILE:\/tmp\/krb5cc_0\r\nDefault principal: host\/sol10x64vm1.exchange.local@EXCHANGE.LOCAL\r\n\r\nValid starting                Expires                Service principal\r\n07\/22\/13 19:52:26  07\/23\/13 05:52:26  krbtgt\/EXCHANGE.LOCAL@EXCHANGE.LOCAL\r\n07\/22\/13 19:52:26  07\/23\/13 05:52:26  ldap\/exchangedc1.exchange.local@EXCHANGE.LOCAL\r\n<\/pre>\n
            * List host keys<\/p>\n
            \r\nklist -e -k \/etc\/krb5\/krb5.keytab\r\nKeytab name: FILE:\/etc\/krb5\/krb5.keytab\r\nKVNO Principal\r\n---- --------------------------------------------------------------------------\r\n   2 host\/sol10x64vm1.exchange.local@EXCHANGE.LOCAL (AES-256 CTS mode with 96-bit SHA-1 HMAC)\r\n   2 host\/sol10x64vm1.exchange.local@EXCHANGE.LOCAL (AES-128 CTS mode with 96-bit SHA-1 HMAC)\r\n   2 host\/sol10x64vm1.exchange.local@EXCHANGE.LOCAL (ArcFour with HMAC\/md5)\r\n   2 host\/sol10x64vm1.exchange.local@EXCHANGE.LOCAL (DES cbc mode with CRC-32)\r\n   2 host\/sol10x64vm1.exchange.local@EXCHANGE.LOCAL (DES cbc mode with RSA-MD5)\r\n<\/pre>\n
            * List \/etc\/krb5\/krb5.conf file content:<\/p>\n
            \r\ncat \/etc\/krb5\/krb5.conf\r\n[libdefaults]\r\n        default_realm = EXCHANGE.LOCAL\r\n\r\n[realms]\r\n        EXCHANGE.LOCAL = {\r\n                kdc = exchangedc1.exchange.local\r\n                kpasswd_server = exchangedc1.exchange.local\r\n                kpasswd_protocol = SET_CHANGE\r\n                admin_server = exchangedc1.exchange.local\r\n        }\r\n\r\n[domain_realm]\r\n        .exchange.local = EXCHANGE.LOCAL\r\n<\/pre>\n
            * Verify presence of Unix attribute for user<\/p>\n
            ldapsearch -h Exchangedc1 -o mech=gssapi -o authzid='' -b \"cn=users,dc=exchange,dc=local\" \"cn=John Doe\"\r\nversion: 1\r\ndn: CN=John Doe,CN=Users,DC=exchange,DC=local\r\nobjectClass: top\r\nobjectClass: person\r\nobjectClass: organizationalPerson\r\nobjectClass: user\r\ncn: John Doe\r\nsn: Doe\r\ngivenName: John\r\ndistinguishedName: CN=John Doe,CN=Users,DC=exchange,DC=local\r\n...\r\nuid: johndoe\r\nmsSFU30Name: johndoe\r\nmsSFU30NisDomain: exchange\r\nuidNumber: 10100\r\ngidNumber: 100\r\nunixHomeDirectory: \/export\/home\/johndoe\r\nloginShell: \/bin\/bash\r\n<\/pre>\n
            Initialize Solaris LDAP Client<\/h2><\/span>\n
            * This allows Solaris host to access naming service from AD<\/p>\n
            Prerequisites<\/h3><\/span>\n
            * DNS client is enabled:<\/p>\n
            \r\nsvcadm enable svc:\/nework\/dns\/client:default\r\n\r\nsvcs -a |grep dns\r\ndisabled       Jul_20   svc:\/network\/dns\/server:default\r\nonline         18:34:27 svc:\/network\/dns\/client:default\r\n<\/pre>\n
            * nscs, which is Solaris caching daemon, is enabled in order to use per-user authentication functionality:<\/p>\n
            \r\nsvcadm enable name-service-cache\r\n\r\nsvcs -a |grep name-service\r\nonline         19:53:01 svc:\/system\/name-service-cache:default\r\n<\/pre>\n
            * \/etc\/resolv.conf file is properly configured:<\/p>\n
            \r\ncat \/etc\/resolv.conf\r\ndomain exchange.local\r\nnameserver 192.168.1.30\r\n<\/pre>\n
            * Both forward and reverse DNS lookup for AD server are successful<\/p>\n
            \r\nnslookup exchangedc1\r\nnslookup 192.168.1.30\r\n<\/pre>\n
            * \/etc\/nsswitch.ldap uses DNS for hosts and ipnodes<\/p>\n
            \r\ncat \/etc\/nsswitch.ldap|grep dns\r\nhosts:      dns ldap [NOTFOUND=return] files\r\nipnodes:    dns ldap [NOTFOUND=return] files\r\n<\/pre>\n
            Initialize with ldapclient<\/h3><\/span>\n
            * Run ldapclient:<\/p>\n
            \r\nldapclient -v manual \\\r\n-a credentialLevel=self \\\r\n-a authenticationMethod=sasl\/gssapi \\\r\n-a defaultSearchBase=dc=exchange,dc=local \\\r\n-a domainName=exchange.local \\\r\n-a defaultServerList=192.168.1.30 \\\r\n-a attributeMap=passwd:gecos=cn \\\r\n-a attributeMap=passwd:homedirectory=unixHomeDirectory \\\r\n-a objectClassMap=group:posixGroup=group \\\r\n-a objectClassMap=passwd:posixAccount=user \\\r\n-a objectClassMap=shadow:shadowAccount=user \\\r\n-a serviceSearchDescriptor=passwd:cn=users,dc=exchange,dc=local?one \\\r\n-a serviceSearchDescriptor=group:cn=users,dc=exchange,dc=local?one\r\n<\/pre>\n
            \r\n> > > > > > > > > > > > Parsing credentialLevel=self\r\nParsing authenticationMethod=sasl\/gssapi\r\n...\r\nArguments parsed:\r\n        authenticationMethod: sasl\/gssapi\r\n        defaultSearchBase: dc=exchange,dc=local\r\n...\r\nAbout to modify this machines configuration by writing the files\r\nStopping network services\r\nStopping sendmail\r\n...\r\nldap not running\r\nnisd not running\r\nnis(yp) not running\r\nfile_backup: stat(\/etc\/nsswitch.conf)=0\r\nfile_backup: (\/etc\/nsswitch.conf -> \/var\/ldap\/restore\/nsswitch.conf)\r\n..\r\nStarting network services\r\nstart: \/usr\/bin\/domainname exchange.local... success\r\nstart: DNS client is enabled\r\n...\r\nrestart: sleep 100000 microseconds\r\nrestart: milestone\/name-services:default... success\r\nSystem successfully configured\r\n<\/pre>\n
            * Restart LDAP client<\/p>\n
            \r\nsvcadm restart svc:\/network\/ldap\/client:default\r\nsvcs -a|grep ldap\r\nonline         19:54:08 svc:\/network\/ldap\/client:default\r\n<\/pre>\n
            * Verify the contents of LDAP client cache:<\/p>\n
            \r\n# ldapclient list\r\nNS_LDAP_FILE_VERSION= 2.0\r\nNS_LDAP_SERVERS= 192.168.1.30\r\nNS_LDAP_SEARCH_BASEDN= dc=exchange,dc=local\r\nNS_LDAP_AUTH= sasl\/GSSAPI\r\nNS_LDAP_CACHETTL= 0\r\nNS_LDAP_CREDENTIAL_LEVEL= self\r\nNS_LDAP_SERVICE_SEARCH_DESC= passwd:cn=users,dc=exchange,dc=local?one\r\nNS_LDAP_SERVICE_SEARCH_DESC= group:cn=users,dc=exchange,dc=local?one\r\nNS_LDAP_ATTRIBUTEMAP= passwd:homedirectory=unixHomeDirectory\r\nNS_LDAP_ATTRIBUTEMAP= passwd:gecos=cn\r\nNS_LDAP_OBJECTCLASSMAP= shadow:shadowAccount=user\r\nNS_LDAP_OBJECTCLASSMAP= passwd:posixAccount=user\r\nNS_LDAP_OBJECTCLASSMAP= group:posixGroup=group\r\n<\/pre>\n
            Using Naming Service Switch and PAM<\/h3><\/span>\n
            * cat \/etc\/nsswitch.conf<\/p>\n
            \r\npasswd:     files ldap\r\ngroup:      files ldap\r\n\r\nhosts:      dns ldap [NOTFOUND=return] files\r\n\r\nipnodes:    dns ldap [NOTFOUND=return] files\r\n<\/pre>\n
            * Add to \/etc\/pam.conf
            \nlogin auth sufficient pam_krb5.so.1
            \nother auth sufficient pam_krb5.so.1
            \nother account required pam_krb5.so.1
            \nother password sufficient pam_krb5.so.1<\/p>\n
            \r\n# grep pam_krb5 \/etc\/pam.conf\r\nlogin auth sufficient pam_krb5.so.1\r\nkrlogin auth required           pam_krb5.so.1\r\nkrsh    auth required           pam_krb5.so.1\r\nktelnet auth required           pam_krb5.so.1\r\nother auth sufficient pam_krb5.so.1\r\nother account required pam_krb5.so.1\r\nother password sufficient pam_krb5.so.1\r\n<\/pre>\n<\/h3>\n
            * getent<\/p>\n
            \r\n# getent passwd johndoe\r\njohndoe:x:10100:100:John Doe:\/export\/home\/johndoe:\/bin\/bash\r\n<\/pre>\n
            * ldaplist<\/p>\n
            \r\n# ldaplist -l passwd johndoe\r\ndn: gecos=John Doe,gecos=Users,DC=exchange,DC=local\r\n        objectClass: top\r\n        objectClass: person\r\n        objectClass: organizationalPerson\r\n        objectClass: posixAccount\r\n        cn: John Doe\r\n        sn: Doe\r\n        givenName: John\r\n        distinguishedName: CN=John Doe,CN=Users,DC=exchange,DC=local\r\n...\r\n        uid: johndoe\r\n        msSFU30Name: johndoe\r\n        msSFU30NisDomain: exchange\r\n        uidNumber: 10100\r\n        gidNumber: 100\r\n        homedirectory: \/export\/home\/johndoe\r\n        loginShell: \/bin\/bash\r\n        gecos: John Doe\r\n<\/pre>\n
            * Create home directory for johndoe<\/p>\n
            \r\nmkdir \/export\/home\/johndoe\r\nchown johndoe \/export\/home\/johndoe\r\n<\/pre>\n
            * Login as johndoe<\/p>\n
            \r\nbash-3.2$ id\r\nuid=10100(johndoe) gid=100\r\nbash-3.2$ klist\r\nTicket cache: FILE:\/tmp\/krb5cc_10100\r\nDefault principal: johndoe@EXCHANGE.LOCAL\r\n\r\nValid starting                Expires                Service principal\r\n07\/22\/13 21:07:06  07\/23\/13 07:07:06  krbtgt\/EXCHANGE.LOCAL@EXCHANGE.LOCAL\r\n        renew until 07\/29\/13 21:07:06\r\n07\/22\/13 21:07:06  07\/23\/13 07:07:06  ldap\/exchangedc1.exchange.local@EXCHANGE.LOCAL\r\n        renew until 07\/29\/13 21:07:06\r\n<\/pre>\n
            Test Password Management<\/h3><\/span>\n
            * Login as johndoe and change password with kpasswd (not passwd)<\/p>\n
            Useful Tools<\/h2><\/span>\n
            Export ldif File from AD: ldifde<\/h3><\/span>\n
            \r\nldifde -f johndoe.ldif -d \"CN=John Doe,CN=USERS,DC=exchange,DC=local\"\r\n<\/pre>\n
            ldapadd<\/h3><\/span>\n
            * ldapadd<\/em> command example:<\/p>\n
            \r\nldapadd -h exchangedc1 -D \"cn=Administrator,cn=users,dc=exchange,dc=local\" -w \"Welcome1\" -f johndoe2.ldif -v\r\n<\/pre>\n
            * johndoe2.ldif<\/em><\/p>\n
            \r\ndn: cn=John Doe2,cn=Users,dc=exchange,dc=local\r\nobjectClass: user\r\ncn: John Doe2\r\nsn: Doe2\r\ngivenName: John\r\ndistinguishedName: cn=John Doe2,cn=Users,dc=exchange,dc=local\r\ndisplayName: John Doe2\r\nsAMAccountName: johndoe2\r\nuserPrincipalName: johndoe2@exchange.local\r\naccountExpires: 0\r\nmsSFU30NisDomain: exchange\r\nuid: johndoe2\r\nuidNumber: 10102\r\ngidNumber: 100\r\nunixHomeDirectory: \/export\/home\/johndoe2\r\nloginShell: \/bin\/bash\r\n<\/pre>\n
            ldapmodify<\/h3><\/span>\n
            \r\nldapadd -h exchangedc1 -D \"cn=Administrator,cn=users,dc=exchange,dc=local\" -w \"Welcome1\" -f johndoe2b.ldif -v\r\n<\/pre>\n
            * johndoe2.ldif<\/em><\/p>\n
            \r\ndn: cn=John Doe2,cn=Users,dc=exchange,dc=local\r\nchangetype: modify \r\nreplace: userAccountControl\r\nuserAccountControl: 512\r\n<\/pre>\n
            * Note that this example does not work.<\/p>\n
            References<\/h2><\/span>\n
            * kerberos_s10.pdf<\/a>
            \n*             Solaris 10 and Active Directory Integration<\/a>
            \n*             Solaris Authentication Login with Active Directory
            \n<\/a>
            \n*             Joining Unix-like systems to an Active Directory<\/a>
            \n*             Solaris : automatic creation of home dirs<\/a>
            \n*             Authenticating UNIX\/Linux to Windows 2008R2. Part 2 : Solaris 10<\/a>
            \n*             Creating Active Directory Accounts<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
            Environment * Windows Server 2008R2 Enterprise Edition * Solaris 10 x64 u11 Prepare Windows Server * See this post on how to install Windows Server 2008R2 on ESXi 5.1. Install Identity Management for Unix * Login Windows Server 2008R2. * … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[287,45],"tags":[275,628,566,571],"class_list":["post-7702","post","type-post","status-publish","format-standard","hentry","category-kerberos","category-solaris","tag-ad","tag-kerberos","tag-ldap","tag-solaris"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p8cRUO-20e","_links":{"self":[{"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/posts\/7702","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7702"}],"version-history":[{"count":21,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/posts\/7702\/revisions"}],"predecessor-version":[{"id":7884,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/posts\/7702\/revisions\/7884"}],"wp:attachment":[{"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7702"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7702"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7702"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}