0

I posted a similar question over on super user

I'm trying to configure Ubuntu to login to ldap. I've come across several related posts, but I'm still confused:

How does pam_ldap find ldap users? Do I have to manually create an entry in /etc/passwd for every user in ldap?

The reason I ask is because I seem to be able to authenticate against ldap as long as I have a username inside the /etc/passwd file that corresponds to uid in ldap.

For example, user1 has a local account (that I created with adduser). There is also a ldap user uid=user1,ou=people,dc=mydomain,dc=com. The local password for user1 is different than the password for the ldap with the same uid. I can login with both passwords. Also, if I comment out the pam_unix line in common-auth, it will only let me in using the password defined in ldap.

So, I'm pretty sure pam_ldap is working. But when I try to log in using a user defined in ldap (but who does NOT have an entry in /etc/passwd), auth.log shows "invalid user".

So, I must be missing a step? Is there a way to sync ldap users into /etc/passwd? Or perhaps a config option to have pam_ldap create a corresponding local account when an ldap user first attempts to login?

2 Answers 2

2

You should have an entry in nsswitch.conf using the ldap module for passwd. A user's passwd entry is unassociated with their authentication mechanism; it's just handy to keep them both in LDAP if that's a good solution for you.

passwd:      db ldap files

is a good entry.

You'll also need to make sure that your /etc/ldap.conf file is properly configured, although the defaults (except the base and host of course ;)) might work just fine. And lastly, ensure that the ldap nss module is installed.

7
  • As I mentioned in a comment in my now downrated post, Debian/Ubuntu uses 'compat' instead of specific entries. Local services will poll ldap if you don't have pam_unix firing first.
    – thinice
    Jun 21, 2011 at 18:36
  • @rovangju pretty sure compat doesn't add ldap. I've used it myself for NIS until I stopped using NIS. If you know otherwise, docs? I noticed that your link specifically says to add ldap in an nsswitch.conf entry, just as I said. Jun 21, 2011 at 19:45
  • Thanks so much for your help. I started "nslcd -d" to get debug statements and noticed it's using this to search: filter="(&(objectClass=posixAccount)(uid=blah))"). Do you know how can I tell nss to use "inetOrgPerson" instead of "posixAccount"? Jun 21, 2011 at 21:07
  • Getting closer. I added filter passwd (objectClass=inetOrgPerson). And now I see this in nslcd debug statements: passwd entry <blah> does not contain uidNumber value. I tried to add uidNumber as an attribute, but LDAP isn't letting me, so looks like I need to read up more on LDAP.... Jun 21, 2011 at 21:19
  • ah, gotcha. you need to use posixAccount instead of inetorgperson. posixAccount extends inetOrgPerson, adding the additional fields you need for a passwd line: homedir, shell, etc. Jun 21, 2011 at 22:01
1

You may have to add a directive to common-password to load up pam-ldap as well. The pam ldap module should have options for user creation from ldap.

Edit: user/homedir creation actually taken care of from another module, not pam-ldap.

Debian has a very nice extensive guide here: http://wiki.debian.org/LDAP/PAM

Take a look at pam_mkhomedir's usage on that page.

4
  • This is a problem with nss configuration, as Micheal answered, not with the PAM configuration. Jun 21, 2011 at 9:24
  • @theotherreceive Not necessarily. Ubuntu/Debian uses 'passwd: compat' - Additionally, if you put 'ldap' in front of files in nsswitch - local services will poll ldap before local files - inefficient. 'Compat' will defer to what's setup in the /etc/pam.d/common-* files.
    – thinice
    Jun 21, 2011 at 18:34
  • 1
    +1 for the link to the debian wiki. That is a great resource. I'll definitely refer to it many times in the future. Jun 21, 2011 at 21:08
  • yes necessarily. The question pretty clearly states that authentication works, therefore the problem is not with the PAM configuration, but with the nss ldap setup. Jun 28, 2011 at 8:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .