Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a given LDAP-Server I want to use for User Authentication on my Red Hat Enterprise Linux 5.8 Server. I got the connection to the LDAP-Server working and I'm able to Login to the Linux Server by LDAP User "username".

Now I want that only users from one LDAP group can Login to my RHEL Server. I tried to do this by configuring the following in /etc/ldap.conf:

pam_groupdn cn=RW,ou=ApplRoles,ou=App,ou=Applications,dc=sbb,dc=CH
pam_member_attribute AppRoles

When I try to login after configuring this I get the following message:

"You must be a AppRoles of cn=RW,ou=ApplRoles,ou=App,ou=Applications,dc=sbb,dc=CH".

But when I browse through the LDAP-Server, I see that the User is part of this Group:

# ldapsearch -h -D cn=binduser,ou=Administrators,dc=company,dc=CH -w bindpw -b dc=company,dc=ch -x "(cn=username)" AppRoles
companyAppRoles: cn=RW,ou=ApplRoles,ou=App,ou=Applications,dc=company,dc=CH

The Requests and Answer look like this in Wireshark (dumped by tcpdump on the Linux-Server):

Request (From Wireshark Dump):

 LDAPMessage compareRequest(5) "cn=RW,ou=ApplRoles,ou=App,ou=Applications,dc=company,dc=CH"
 messageID: 5
 protocolOp: compareRequest (14)
   entry: cn=RW,ou=ApplRoles,ou=App,ou=Applications,dc=company,dc=CH
    attributeDesc: AppRoles
    assertionValue: cn=username,ou=OU,dc=company,dc=CH

Answer (From Wireshark Dump):

LDAPMessage compareResponse(5) noSuchObject ([DSA]:No such object:cn=RW,ou=ApplRoles,ou=App,ou=Applications,dc=company,dc=CH)
 messageID: 5
 protocolOp: compareResponse (15)
   resultCode: noSuchObject (32)
   matchedDN: ou=Applications,dc=company,dc=CH
   errorMessage: [DSA]:No such object:cn=RW,ou=ApplRoles,ou=App,ou=Applications,dc=company,dc=CH

So the LDAP admin said, I should try to change the "assertionValue" to "cn=username" only.

Has anyone an Idea how to change this value? Or are there other options to restrict the access to my server to the users of an LDAP group?

share|improve this question
up vote 0 down vote accepted

I was able to solve the problem by setting the pam_filter in /etc/ldap.conf:

# Filter to AND with uid=%s
pam_filter AppRoles=cn=RW,ou=ApplRoles,ou=App,ou=Applications,dc=company,dc=CH

The password will only be transmitted to the LDAP Server as a new bindRequest, if the the user Filter and the pam_filter will return attributes. So the user has to be in this group to be able to check the credentials.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.