I have set up an OpenLDAP server on RHEL 5.4, and am configuring other servers to authenticate against it. I have both ldap with StartTLS and ldaps configured and working.
On my client machines, my /etc/nsswitch.conf includes:
passwd: files ldap shadow: files ldap group: files ldap
I can successfully log in to a client with a user that is only defined in LDAP (i.e. its not finding it in /etc/passwd, and is successfully asking LDAP for user info, and authenticating against the password hash stored in LDAP).
My problem is when I try to lock down access to attributes in the LDAP server, specifically, in /etc/openldap/slapd.conf, ldap users can no longer log in:
access to attrs=userpassword by self write by anonymous auth by * none
I'm logging slapd, and it appears (my interpretation, correct me if I'm wrong) that pam_ldap is attempting to read all the attributes in the poxixAccount objectClass:
filter: (&(objectClass=posixAccount)(uid=cthompson)) attrs: uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass
In my openldap logging, I get no access or acl errors, but I do get:
access_allowed: search access to "uid=cthompson,ou=People,dc=domain,dc=com" "objectClass" requested access_allowed: search access to "uid=cthompson,ou=People,dc=domain,dc=com" "uid" requested
Is there something that needs to be configured so instead of reading the userPassword attribute, pam_ldap tries to "auth" against it (so the requests gets handled by the "by anonymous auth" access rule?