Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've installed nss_ldap, edited nsswitch.conf to use ldap; here is my /etc/ldap.conf contents:

host ldap.<mycompany>.com
base o=<mycompany>,c=<cc>
bind_policy soft
nss_reconnect_tries 4
nss_reconnect_sleeptime 1
nss_reconnect_maxsleeptime 16
nss_reconnect_maxconntries 2

When I do

getent passwd

I get a correct view of all the usernames in the company. But if I do

getent passwd <some user>

with a known valid username, nothing is returned, as if the user didn't exist. (it works for local non-ldap users)

If I compile nss_ldap with debug enabled, the former prints out a lot of debugging messages like: nss_ldap: ==> do_result nss_ldap: <== do_result nss_ldap: ==> _nss_ldap_assign_userpassword nss_ldap: <== _nss_ldap_assign_userpassword

but the latter does not show anything. There's nothing in syslog either.

This quite puzzles me. Where should I start looking for the problem ? any ideas where it could be ?

The client is running Gentoo linux, nss_ldap-264. The LDAP server is out of my control.

share|improve this question
up vote 3 down vote accepted

Do you use nscd, the naming caching daemon ? It could have a negative-cache of the user, in which case running /usr/sbin/nscd -i passwd would invalidate the cache and cause a re-fetch.

getent passwd works because it bypasses nscd.

share|improve this answer
Good catch, thanks! For some reason, "nscd -i passwd" did not fix the problem, but restarting nscd did... – b0fh Aug 31 '10 at 16:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.