Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've started a new job at a house where they've got an amazingly unruly patchwork of Linux, xBSD, and OpenSolaris boxes. Every box has its own user auth using local /etc/passwd, etc. Users/Groups have differing uids/gids on each machine, and each machine has its own /home/ tree. (no central NAS /homes) My job is get get everything into an LDAP directory and use that for login auth. How do I get LDAP to deal with the differing uids/gids?


share|improve this question

You ultimately fix the uid/gids to consolidate them.

Or you consolidate them somehow. You could use a meta directory of some kind that stores the uid per system on each user object. (Same for gid).

Thus you could have all the values on an object, but you would need a way to distinguish them for LDAP binds against the meta directory. Perhaps by a different uid attribute per system, (which would get unwieldy) and then configure each system to use its own uid attribute, instead of default uid.

Based on the comment, and thinking about it further, I would think that this is maybe something you could do without an IDM style system, but rather just stand up an LDAP server of choice. Then export your data from all your sources, and consolidate it. I.e. For every geoffc user, find all the uid's in the data sources. Then add a SystemAuid=123, SystemBuid=999, SystemCuid=767543 and so on in an LDIF file.

Then configure SystemA to use SystemAuid= instead of uid= in its pam/ldap config. And so on.

Same basic idea for groups. An IDM style system would be setup to do the data work on its own as part of the basic processes and maintain it as changes happen in each system over time.

You would need to add a process in place to add new users to your LDAP. In which case, you would chose the next available free uid, and assign it to all the values for this user, so going forward you move away from multiple values.

share|improve this answer
Sounds good. How? – Frank Brenner Dec 21 '10 at 22:11
Pick your IDM style product if you want it to sync live. No great free ones. Pick one that has fun syntax's in its meta directory. I happen to do a lot of Novell IDM, in which this is fairly straightforward (to me, at least). So since you want to make them all use the LDAP source, you could get away with just setting up a single LDAP server, with the needed attributes. – geoffc Dec 22 '10 at 15:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.