Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a network of computers which are using LDAP for user authentication (Free IPA v1.2). I am using the same LDAP server, but a different DN subtree, for external users of a web portal. I have just added a new third party web application which uses PAM to authenticate users, so I've added

auth      required       pam_ldap.so
account   required       pam_ldap.so

to the /etc/pam.d/new_webapp PAM configuration file. The problem is that this uses /etc/ldap.conf which looks to authenticate users from the system base DN (i.e. users who can ssh in with a username/password), but instead I'd like it to use a different base DN: the one associated with the web portal users. I had hoped /etc/pam_ldap.conf might help me with this, but no luck. What would be beautiful would be if I could do something like:

auth      required       pam_ldap.so conf /etc/ldap_web.conf

or

auth      required       pam_ldap.so base "cn=accounts, cn=webportal, dc=example, dc=com"

I'm looking for suggestions on how I can solve this. The only other thing I can think of is to compile an alternative pam_ldap.so that looks at an alternative configuration file.

Thanks in advance for any feedback on this problem.

Ian

Here is the exception I get when I try to login with a user that is only on the webportal (web i/f):

Apr 29 02:22:31 portal rserver[7341]: ERROR pam_authenticate failed: User not known to the 
underlying authentication module; LOGGED FROM: int server::pam_auth::
<unnamed>::PAMAuth::login(const std::string&, const std::string&)
/root/rstudio/src/cpp/server/ServerPAMAuth.cpp:201

And this is the error when I try to login with a user that does have a system account:

Apr 29 02:22:48 portal rserver[7342]: ERROR pam_authenticate failed: Module is unknown;
LOGGED FROM: int server::pam_auth::<unnamed>::PAMAuth::login(const std::string&
const std::string&) /root/rstudio/src/cpp/server/ServerPAMAuth.cpp:201
share|improve this question
    
Please tell us which OS your speaking about. Afaik there are different solutions for different systems. –  binfalse Apr 29 '11 at 7:02
add comment

1 Answer

up vote 1 down vote accepted

You can do exactly what you're asking for. Use:

auth        required       pam_ldap.so config=/etc/ldap_web.conf

See the man page for more details.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.