I'm setting up a debian squeeze to authenticate against Active Directory 2008R2. Part of nslcd.conf is below:
uri ldap://bddc.test.local
base dc=test,dc=local
binddn cn=blah,ou=Public Services,dc=test,dc=local
bindpasswd xxxxx
scope subtree
pagesize 1000
referrals off
filter passwd (&(objectClass=user)(uidNumber=*)(unixHomeDirectory=*))
map passwd uid sAMAccountName
map passwd homeDirectory unixHomeDirectory
map passwd gecos displayName
map passwd userPassword unixUserPassword
filter shadow (&(objectClass=user)(uidNumber=*)(unixHomeDirectory=*))
map shadow uid sAMAccountName
map shadow shadowLastChange pwdLastSet
filter group (&(objectClass=group)(gidNumber=*))
map group uniqueMember member
When I tried to ssh to that server with the user staff.test the debug of nslcd shows:
nslcd: [b0dc51] DEBUG: connection from pid=31632 uid=0 gid=0
nslcd: [b0dc51] DEBUG: nslcd_pam_authc("staff.test","","sshd","***")
nslcd: [b0dc51] DEBUG: myldap_search(base="dc=test,dc=local", filter="(&(&(objectClass=user)(uidNumber=*)(unixHomeDirectory=*))(sAMAccountName=staff.test))")
nslcd: [b0dc51] DEBUG: ldap_initialize(ldap://bddc.test.local)
nslcd: [b0dc51] DEBUG: ldap_set_rebind_proc()
nslcd: [b0dc51] DEBUG: ldap_set_option(LDAP_OPT_PROTOCOL_VERSION,3)
nslcd: [b0dc51] DEBUG: ldap_set_option(LDAP_OPT_DEREF,0)
nslcd: [b0dc51] DEBUG: ldap_set_option(LDAP_OPT_TIMELIMIT,0)
nslcd: [b0dc51] DEBUG: ldap_set_option(LDAP_OPT_TIMEOUT,0)
nslcd: [b0dc51] DEBUG: ldap_set_option(LDAP_OPT_NETWORK_TIMEOUT,0)
nslcd: [b0dc51] DEBUG: ldap_set_option(LDAP_OPT_REFERRALS,LDAP_OPT_OFF)
nslcd: [b0dc51] DEBUG: ldap_set_option(LDAP_OPT_RESTART,LDAP_OPT_ON)
nslcd: [b0dc51] DEBUG: ldap_simple_bind_s("CN=blah,OU=Public Services,DC=test,DC=local","***") (uri="ldap://bddc.test.local")
nslcd: [b0dc51] DEBUG: ldap_result(): end of results
nslcd: [b0dc51] "staff.test": user not found
When I tried with ldapsearch:
ldapsearch -x -H ldap://bddc.test.local -D "cn=blah,ou=Public Services,dc=test,dc=local" -w xxxx "uid=staff.test" -b "dc=test,dc=local"
# extended LDIF
#
# LDAPv3
# base <dc=test,dc=local> with scope subtree
# filter: uid=staff.test
# requesting: ALL
#
# Staff Test, User, vgu.local
dn: CN=Staff Test,OU=User,DC=vgu,DC=local
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Staff Test
sn: Test
givenName: Staff
...
The "getenv passwd staff.test" didn't show any thing. The "getenv passwd" only shows one ldap user is the "blah" - the one is used to bind.
Could anybody tell me what's wrong please?
Thanks.