Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to configure LDAP configuration the same way we configure it for our web applications:

  1. The server binds using the administrator account provided
  2. The server searches for uid=$login where $login is the login the user used to login. If the LDAP entry is not found, then we error out.
  3. Now that we have the DN, the server attempts to verify the password.

I have an additional caveat: the requirement that the $login is a local user already. However, I think I'd be able to do that with a simple PAM modification. If someone has a suggestion, for this part, I'm open to it.

Is this possible? This does not match up with the traditional LDAP authentication implementations I've read in docs, articles and in SF.

share|improve this question
up vote 0 down vote accepted

If you want system authentication and LDAP to play together nicely, NSSLdap might be a place to start reading.

Are you ultimately trying to check if a system user exists by querying LDAP? Because if that is not the case, and you merely just need LDAP to list all the same users that are found in the system, you may just want to make a simple tool for checking the user database and syncing it to the LDAP tree.

EDIT: Forgot the link:

share|improve this answer
I am trying to compare password with that in LDAP. – Belmin Fernandez Nov 11 '11 at 20:31
Compare system password again LDAP password for "same" username/login? – Tim Nov 11 '11 at 20:32
Yes that is the goal. Pipe dream? – Belmin Fernandez Nov 11 '11 at 21:24
not a pipe dream, but doesn't make sense to me, because you will have to keep password in sync. using nssldap that I listed above will force the system to use the LDAP password as the system password, eliminating the need to keep them in sync and the need to programatically check that they match. – Tim Nov 11 '11 at 21:48
unless of course there is two separate processes that create the passwords, and you don't expect them to be different – Tim Nov 11 '11 at 21:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.