Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm setting up a debian squeeze to authenticate against Active Directory 2008R2. Part of nslcd.conf is below:

uri ldap://bddc.test.local
base dc=test,dc=local
binddn cn=blah,ou=Public Services,dc=test,dc=local
bindpasswd xxxxx
scope subtree
pagesize 1000
referrals off
filter passwd (&(objectClass=user)(uidNumber=*)(unixHomeDirectory=*))
map    passwd uid              sAMAccountName
map    passwd homeDirectory    unixHomeDirectory
map    passwd gecos            displayName
map    passwd userPassword     unixUserPassword
filter shadow (&(objectClass=user)(uidNumber=*)(unixHomeDirectory=*))
map    shadow uid              sAMAccountName
map    shadow shadowLastChange pwdLastSet
filter group (&(objectClass=group)(gidNumber=*))
map    group  uniqueMember     member

When I tried to ssh to that server with the user staff.test the debug of nslcd shows:

nslcd: [b0dc51] DEBUG: connection from pid=31632 uid=0 gid=0
nslcd: [b0dc51] DEBUG: nslcd_pam_authc("staff.test","","sshd","***")
nslcd: [b0dc51] DEBUG: myldap_search(base="dc=test,dc=local", filter="(&(&(objectClass=user)(uidNumber=*)(unixHomeDirectory=*))(sAMAccountName=staff.test))")
nslcd: [b0dc51] DEBUG: ldap_initialize(ldap://bddc.test.local)
nslcd: [b0dc51] DEBUG: ldap_set_rebind_proc()
nslcd: [b0dc51] DEBUG: ldap_set_option(LDAP_OPT_PROTOCOL_VERSION,3)
nslcd: [b0dc51] DEBUG: ldap_set_option(LDAP_OPT_DEREF,0)
nslcd: [b0dc51] DEBUG: ldap_set_option(LDAP_OPT_TIMELIMIT,0)
nslcd: [b0dc51] DEBUG: ldap_set_option(LDAP_OPT_TIMEOUT,0)
nslcd: [b0dc51] DEBUG: ldap_set_option(LDAP_OPT_NETWORK_TIMEOUT,0)
nslcd: [b0dc51] DEBUG: ldap_set_option(LDAP_OPT_REFERRALS,LDAP_OPT_OFF)
nslcd: [b0dc51] DEBUG: ldap_set_option(LDAP_OPT_RESTART,LDAP_OPT_ON)
nslcd: [b0dc51] DEBUG: ldap_simple_bind_s("CN=blah,OU=Public Services,DC=test,DC=local","***") (uri="ldap://bddc.test.local")
nslcd: [b0dc51] DEBUG: ldap_result(): end of results
nslcd: [b0dc51] "staff.test": user not found

When I tried with ldapsearch:

ldapsearch -x -H ldap://bddc.test.local -D "cn=blah,ou=Public Services,dc=test,dc=local" -w xxxx "uid=staff.test" -b "dc=test,dc=local"

# extended LDIF
# LDAPv3
# base <dc=test,dc=local> with scope subtree
# filter: uid=staff.test
# requesting: ALL

# Staff Test, User, vgu.local
dn: CN=Staff Test,OU=User,DC=vgu,DC=local
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Staff Test
sn: Test
givenName: Staff

The "getenv passwd staff.test" didn't show any thing. The "getenv passwd" only shows one ldap user is the "blah" - the one is used to bind.

Could anybody tell me what's wrong please?


share|improve this question

The configurable portion of nslcd search filter that failed to find the user was:


The ldapsearch filter that succeeded was:


In english, the configurable portion of the nslcd filter requires entries to:

  1. Be derived from the "user" class AND
  2. Have a value for the "uidNumber" field AND
  3. Have a value for the "unixHomeDirectory" field

If any of these conditions are not met, then the entry won't be included in the results.

Have you confirmed that this "staff.test" user does in fact have values for uidNumber and unixHomeDirectory in their AD account? Otherwise, you might try temporarily reducing the filter to:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.