I have several linux servers (ubuntu 12.04) setup to authenticate user logins over an external (to my branch office) LDAP (Novell Edirectory specifically). This is working well, however I am trying to filter user logins by membership in an LDAP group.
A user account looks like this in Edir:
dn: cn=mmcloud,ou=eng,o=lsi
loginShell: /bin/bash
homeDirectory: /home/mmcloud
gidNumber: 2001
uidNumber: 9418
mail: xxxxxx@xxxxxxxxx
uid: mmcloud
initials: Q
givenName: Moran
sn: McCloud
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: ndsLoginProperties
objectClass: Person
objectClass: Top
objectClass: posixAccount
eMailAddress: 7#xxxxx@xxxxxxxxxxxx
cn: mmcloud
A group entry looks like this in Edir:
dn: cn=shellacct,ou=groups,ou=eng,o=lsi
memberUid: jbarlin
memberUid: mmccloud
memberUid: ssemryn
memberUid: cdesmon
gidNumber: 2009
objectClass: groupOfNames
objectClass: Top
objectClass: posixGroup
I only want users in the shellacct
group to login. I've found many examples using pam_filter
in /etc/ldap.conf
but have only gotten the filter to work by filtering on specific userDn
attributes such as:
pam_filter &(objectclass=user)
pam_filter &(objectclass=Person)
pam_filter &(loginShell=/bin/bash)
What I want is to filter on the group membership. The groupDn
is cn=shellacct,ou=groups,ou=eng,o=lsi
(gid=2009). I've tried in /etc/ldap.conf
:
pam_filter &(objectclass=posixAccount)(|(gidNumber=2009))
pam_filter |(member=cn=shellacct,ou=groups,ou=eng,o=lsi)
pam_filter |(memberUid=cn=shellacct,ou=groups,ou=eng,o=lsi)
Will pam_filter
work for what I want to do or does it only look at the userDn
for filtering?
libpam-ldap
(which you are using) altogether. It is much more comfortable to use, featureful and documented, and the SSSD version in Ubuntu 12.04 works very well.