I've been able to get some of my linux servers authenticating users against my LDAP directory server, but I've been having some trouble trying to do this with nss_ldap and pam_ldap in FreeBSD.
Going from FreeBSD official docs here: http://www.freebsd.org/doc/en/articles/ldap-auth/client.html
I install the 2 packages, and create a config file /usr/local/etc/ldap.conf, and also a symlink to this file in the same directory, nss_ldap.conf. According to the docs they can both use the same config file. I'm keeping it very simple until I can get it working:
ldap.conf/nss_ldap.conf:
base dc=corp,dc=example,dc=org
host 192.168.0.100
ldap_version 3
binddn cn=admin,dc=corp,dc=example,dc=org
bindpw secret
NSS works as far as I can tell. A "getent passwd" shows information from the LDAP directory as well as local stuff.
Now I want to authenticate, so I add a line to /etc/pam.d/sshd:
# auth
auth sufficient pam_opie.so no_warn no_fake_prompts
auth requisite pam_opieaccess.so no_warn allow_local
#auth sufficient pam_krb5.so no_warn try_first_pass
#auth sufficient pam_ssh.so no_warn try_first_pass
auth sufficient /usr/local/lib/pam_ldap.so no_warn try_first_pass debug
auth required pam_unix.so no_warn try_first_pass
I restart ssh (not sure if this is necessary), and then try and log in with an LDAP user that doesn't exist locally (coryj). It fails silently and logs show:
Sep 9 13:13:54 freebsd-testbox sshd[12684]: pam_ldap: error trying to bind as user "uid=coryj,ou=Users,dc=corp,dc=example,dc=org" (Invalid credentials)
Why is it trying to bind with the user I'm trying to authenticate when I specified a binddn/bindpw? I also tried rootbinddn with a .secret file with the same result. On linux binddn seems to work, where here it seems to be ignored.
I know my ldap.conf and pam files will need some more work, just trying to convince the thing to bind as admin when authenticating at this point.