Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to get our freebsd servers to auth via AD, but it is giving me problems.

Environment: AD backend (Win 2k8r2). This works with other linux hosts which auth via SSSD
FreeBSD 9.1 for client servers

I have configured everything I can think of, and i think it is correct, but when I try to log in with an AD account, it fails with:

pam_ldap: error trying to bind as user "CN=testuser,CN=Users,DC=example,DC=com" (Invalid credentials)

So I know it is getting past the initial bind, as the DN it is bringing back is correct and has come from the AD server. When it then tries to bind with that DN it can't, which causes the auth to fail. I have tested the test user's creds on the AD server, using ldapsearch and even set it as the default bind DN in ldap.conf and it works for all tests.

I cannot for the life of me figure out why the initial bind works, but then the user's bind fails.

For reference, here are my config files:

/usr/local/etc/ldap.conf

pam_login_attribute uid
base dc=example,dc=com
uri ldap://xxx.xxx.xxx.xxx/
ssl no
binddn CN=ro_user,CN=Users,DC=example,DC=com
bindpw somerandompw

/usr/local/etc/openldap/ldap.conf

pam_login_attribute uid
base dc=example,dc=com
uri ldap://xxx.xxx.xxx.xxx/
ssl no

/etc/pam.d/sshd

auth        sufficient  pam_opie.so     no_warn no_fake_prompts
auth        requisite   pam_opieaccess.so   no_warn allow_local
auth        sufficient  /usr/local/lib/pam_ldap.so  no_warn debug
auth        required    pam_unix.so     no_warn try_first_pass

account     required    pam_nologin.so
account     required    pam_login_access.so
account     required    pam_unix.so
account         required        /usr/local/lib/pam_ldap.so      no_warn ignore_authinfo_unavail ignore_unknown_user

session     required    pam_permit.so

password    required    pam_unix.so     no_warn try_first_pass

EDIT: I had a thought - does anyone know if pam_ldap definitely uses the same bind / authentication process for the initial bind and the authentication bind? I am struggling to grasp how the bind can succeed when it is the initial bind, but fail when it's a bind for authentication.

share|improve this question

1 Answer 1

A couple of things:

1.) If you do a getent passwd $username for a user that only exists in ldap, does it pull back the correct entry?

2.) What does your /etc/pam.d/system-auth file look like.

3.) Does it return the results properly for

ldapsearch -D $BINDDN -W -H ldap://$HOST 'uid=$RANDOM_USER'

Lastly, It looks like the binddn you have in /usr/local/etc/ldap.conf is using ro_user and the binddn pam is auth'ing with is testuser. Why the discrepancy. Make sure both work with ldapsearch

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.