Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've got a set of servers that I need to authenticate against a central Active Directory forest. The AD admins have kindly installed the UNIX AD extensions and the NIS ones as well, so I've got a lot of LDAP attributes to work from.

Authenticated binds are working, as are user logins. The one piece I'm missing is the magic sauce to make group enumerations work correctly.

Does anyone have any particular /etc/ldap.conf or perhaps PAM magic that I could employ to make groups work correctly?

To wit:

[root@hostname ~]# groups username
id: cannot find name for group ID 1768498755
[root@hostname ~]#

(The ID is the default group specified via gidNumber.)

Thanks!

share|improve this question

2 Answers 2

Add to /etc/nsswitch.conf:

(if needed: passwd: files sss) group: files sss

Have sssd installed and configure it to search the appropriate space (/etc/sssd/sssd.conf):

[sssd]
domains = LDAP

[domains/LDAP]
ldap_schema = rfc2307bis
id_provider = ldap
auth_provider = ldap
ldap_uri = ldap://localhost
ldap_search_base = ou=users,o=company
ldap_user_search_base = ou=users,o=company
ldap_group_search_base = ou=groups,o=company
ldap_tls_reqcert = allow
cache_credentials = true
enumerate = true
min_id = 1
share|improve this answer
    
Getting really close here. I can't seem to start sssd: "Starting sssd: Cannot load configuration database" –  ZaMoose May 2 '11 at 19:44
    
Okay, I had it slightly misconfigured. Now I'm seeing the following in sssd_nss.log: "(Tue May 3 10:06:53 2011) [sssd[pam]] [confdb_get_domain_internal] (1): No enumeration for [AD]!" Ideas? –  ZaMoose May 3 '11 at 14:10

Try to add the following to you /etc/ldap.conf:

nss_base_group          ou=your,o=base

and make sure you also take a look to the ldap to map the gid's. The /etc/nsswitch.conf should contain something like:

group:          files ldap
share|improve this answer
    
it did not help either –  chandank Dec 7 '12 at 1:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.