Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to get our freebsd servers to auth via AD, but it is giving me problems.

Environment: AD backend (Win 2k8r2). This works with other linux hosts which auth via SSSD
FreeBSD 9.1 for client servers

I have configured everything I can think of, and i think it is correct, but when I try to log in with an AD account, it fails with:

pam_ldap: error trying to bind as user "CN=testuser,CN=Users,DC=example,DC=com" (Invalid credentials)

So I know it is getting past the initial bind, as the DN it is bringing back is correct and has come from the AD server. When it then tries to bind with that DN it can't, which causes the auth to fail. I have tested the test user's creds on the AD server, using ldapsearch and even set it as the default bind DN in ldap.conf and it works for all tests.

I cannot for the life of me figure out why the initial bind works, but then the user's bind fails.

For reference, here are my config files:


pam_login_attribute uid
base dc=example,dc=com
uri ldap://
ssl no
binddn CN=ro_user,CN=Users,DC=example,DC=com
bindpw somerandompw


pam_login_attribute uid
base dc=example,dc=com
uri ldap://
ssl no


auth        sufficient     no_warn no_fake_prompts
auth        requisite   no_warn allow_local
auth        sufficient  /usr/local/lib/  no_warn debug
auth        required     no_warn try_first_pass

account     required
account     required
account     required
account         required        /usr/local/lib/      no_warn ignore_authinfo_unavail ignore_unknown_user

session     required

password    required     no_warn try_first_pass

EDIT: I had a thought - does anyone know if pam_ldap definitely uses the same bind / authentication process for the initial bind and the authentication bind? I am struggling to grasp how the bind can succeed when it is the initial bind, but fail when it's a bind for authentication.

share|improve this question

A couple of things:

1.) If you do a getent passwd $username for a user that only exists in ldap, does it pull back the correct entry?

2.) What does your /etc/pam.d/system-auth file look like.

3.) Does it return the results properly for

ldapsearch -D $BINDDN -W -H ldap://$HOST 'uid=$RANDOM_USER'

Lastly, It looks like the binddn you have in /usr/local/etc/ldap.conf is using ro_user and the binddn pam is auth'ing with is testuser. Why the discrepancy. Make sure both work with ldapsearch

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.