RHEL 5.8 LDAP pam_groupdn customisation

Question

I have a given LDAP-Server I want to use for User Authentication on my Red Hat Enterprise Linux 5.8 Server. I got the connection to the LDAP-Server working and I'm able to Login to the Linux Server by LDAP User "username".

Now I want that only users from one LDAP group can Login to my RHEL Server. I tried to do this by configuring the following in /etc/ldap.conf:

pam_groupdn cn=RW,ou=ApplRoles,ou=App,ou=Applications,dc=sbb,dc=CH
pam_member_attribute AppRoles

When I try to login after configuring this I get the following message:

"You must be a AppRoles of cn=RW,ou=ApplRoles,ou=App,ou=Applications,dc=sbb,dc=CH".

But when I browse through the LDAP-Server, I see that the User is part of this Group:

# ldapsearch -h ldapi.company.ch -D cn=binduser,ou=Administrators,dc=company,dc=CH -w bindpw -b dc=company,dc=ch -x "(cn=username)" AppRoles
companyAppRoles: cn=RW,ou=ApplRoles,ou=App,ou=Applications,dc=company,dc=CH

The Requests and Answer look like this in Wireshark (dumped by tcpdump on the Linux-Server):

Request (From Wireshark Dump):

 LDAPMessage compareRequest(5) "cn=RW,ou=ApplRoles,ou=App,ou=Applications,dc=company,dc=CH"
 messageID: 5
 protocolOp: compareRequest (14)
  compareRequest
   entry: cn=RW,ou=ApplRoles,ou=App,ou=Applications,dc=company,dc=CH
   ava
    attributeDesc: AppRoles
    assertionValue: cn=username,ou=OU,dc=company,dc=CH

Answer (From Wireshark Dump):

LDAPMessage compareResponse(5) noSuchObject ([DSA]:No such object:cn=RW,ou=ApplRoles,ou=App,ou=Applications,dc=company,dc=CH)
 messageID: 5
 protocolOp: compareResponse (15)
  compareResponse
   resultCode: noSuchObject (32)
   matchedDN: ou=Applications,dc=company,dc=CH
   errorMessage: [DSA]:No such object:cn=RW,ou=ApplRoles,ou=App,ou=Applications,dc=company,dc=CH

So the LDAP admin said, I should try to change the "assertionValue" to "cn=username" only.

Has anyone an Idea how to change this value? Or are there other options to restrict the access to my server to the users of an LDAP group?

Answer 1

I was able to solve the problem by setting the pam_filter in /etc/ldap.conf:

# Filter to AND with uid=%s
pam_filter AppRoles=cn=RW,ou=ApplRoles,ou=App,ou=Applications,dc=company,dc=CH

The password will only be transmitted to the LDAP Server as a new bindRequest, if the the user Filter and the pam_filter will return attributes. So the user has to be in this group to be able to check the credentials.