2

We have an organization-wide LDAP server and a department-only NIS server. Many users have accounts with the same name on both servers. Is there any way to get Leopard/Snow Leopard machines to query one server, and then the other, and let the user log in if his username/password combination matches at least one record?

I can get either NIS authentication or LDAP authentication. I can even enable both, with LDAP set as higher priority, and authenticate using the name and password listed on the LDAP server. However, in the last case, if I set the LDAP domain as higher-priority in Directory Utility's search path and then provide the username/password pair listed in the NIS record, then my login is rejected even though the NIS server would accept it.

Is there any way to make the OS check the rest of the search path after it finds the username?

Improve this question
2
  • Can you paste the PAM configuration.
    – RainDoctor
    May 19, 2010 at 6:24
  • Thanks for the reply! Unfortunately, pastebin is in read-only mode for some kind of hardware migration, so I'll try again in the morning. If you see this before then, could you tell me which files you want? I'm not familiar with PAM, and I don't want to just blindly put up all of /etc/pam.d/.
    – Wang
    May 19, 2010 at 7:32

1 Answer 1

Reset to default
1

Well, the problem lies here: how pam modules pam_ldap.so and pam_unix.so are stacked. pam_unix.so deals with both nis and local files.

pass debug argument to pam_unix.so pass "debug 4" argument to pam_ldap.so

Append these arguments to every line that got these modules in system-auth file.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .