Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We have an (active directory) LDAP server and I'm trying to use libnss-ldap to resolve ldap users and groups. When I run 'getent passwd', all of the users are returned exactly like I'd expect. However, when I run 'getent group' all of the system groups are returned immediately and then the process hangs and then seems to give up.

/etc/nsswitch.conf:

passwd:         compat ldap
group:          compat ldap
shadow:         compat ldap

hosts:          files dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis

/etc/libnss-ldap.conf:

host 1.1.1.2 1.1.1.3
base DC=ad,DC=domain,DC=tld
binddn CN=pamldap,OU=Service Accounts,OU=GSS,DC=ad,DC=domain,DC=tld
bindpw somepass
uri ldap://ad.domain.tld/
ldap_version 3
nss_paged_results yes
pagesize 10000
nss_base_passwd         OU=Users,OU=GSS,DC=ad,DC=domain,DC=tld
nss_base_shadow         OU=Users,OU=GSS,DC=ad,DC=domain,DC=tld
nss_base_group          OU=Centers,OU=Groups,OU=GSS,DC=ad,DC=domain,DC=tld
nss_map_objectclass posixAccount user
nss_map_objectclass shadowAccount user
nss_map_attribute uid sAMAccountName
nss_map_attribute homeDirectory unixHomeDirectory
nss_map_attribute shadowLastChange pwdLastSet
nss_map_objectclass posixGroup group
nss_map_attribute uniqueMember member
pam_login_attribute sAMAccountName
pam_filter objectclass=User
pam_password ad

/etc/ldap/ldap.conf:

BASE            OU=GSS,DC=ad,DC=domain,DC=tld
URI             ldap://ad.domain.tld
TLS_CACERT      /etc/ssl/certs/ca-certificates.crt

I looked through everything I could find and wasn't able to find anything with the same issue. Hopefully someone can slap me in the face with something really obvious and trivial that I'm doing wrong.

share|improve this question

1 Answer 1

up vote 0 down vote accepted

Turns out the gidNumber attribute was missing from the group. I'm now working on a script to rectify that. Apparently everything I have above is correct. I'm leaving this up for future reference for others.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.