I posted a similar question over on super user

I'm trying to configure Ubuntu to login to ldap. I've come across several related posts, but I'm still confused:

How does pam_ldap find ldap users? Do I have to manually create an entry in /etc/passwd for every user in ldap?

The reason I ask is because I seem to be able to authenticate against ldap as long as I have a username inside the /etc/passwd file that corresponds to uid in ldap.

For example, user1 has a local account (that I created with adduser). There is also a ldap user uid=user1,ou=people,dc=mydomain,dc=com. The local password for user1 is different than the password for the ldap with the same uid. I can login with both passwords. Also, if I comment out the pam_unix line in common-auth, it will only let me in using the password defined in ldap.

So, I'm pretty sure pam_ldap is working. But when I try to log in using a user defined in ldap (but who does NOT have an entry in /etc/passwd), auth.log shows "invalid user".

So, I must be missing a step? Is there a way to sync ldap users into /etc/passwd? Or perhaps a config option to have pam_ldap create a corresponding local account when an ldap user first attempts to login?


You should have an entry in nsswitch.conf using the ldap module for passwd. A user's passwd entry is unassociated with their authentication mechanism; it's just handy to keep them both in LDAP if that's a good solution for you.

passwd:      db ldap files

is a good entry.

You'll also need to make sure that your /etc/ldap.conf file is properly configured, although the defaults (except the base and host of course ;)) might work just fine. And lastly, ensure that the ldap nss module is installed.

  • As I mentioned in a comment in my now downrated post, Debian/Ubuntu uses 'compat' instead of specific entries. Local services will poll ldap if you don't have pam_unix firing first. – thinice Jun 21 '11 at 18:36
  • @rovangju pretty sure compat doesn't add ldap. I've used it myself for NIS until I stopped using NIS. If you know otherwise, docs? I noticed that your link specifically says to add ldap in an nsswitch.conf entry, just as I said. – Michael Lowman Jun 21 '11 at 19:45
  • Thanks so much for your help. I started "nslcd -d" to get debug statements and noticed it's using this to search: filter="(&(objectClass=posixAccount)(uid=blah))"). Do you know how can I tell nss to use "inetOrgPerson" instead of "posixAccount"? – Upgradingdave Jun 21 '11 at 21:07
  • Getting closer. I added filter passwd (objectClass=inetOrgPerson). And now I see this in nslcd debug statements: passwd entry <blah> does not contain uidNumber value. I tried to add uidNumber as an attribute, but LDAP isn't letting me, so looks like I need to read up more on LDAP.... – Upgradingdave Jun 21 '11 at 21:19
  • ah, gotcha. you need to use posixAccount instead of inetorgperson. posixAccount extends inetOrgPerson, adding the additional fields you need for a passwd line: homedir, shell, etc. – Michael Lowman Jun 21 '11 at 22:01

You may have to add a directive to common-password to load up pam-ldap as well. The pam ldap module should have options for user creation from ldap.

Edit: user/homedir creation actually taken care of from another module, not pam-ldap.

Debian has a very nice extensive guide here: http://wiki.debian.org/LDAP/PAM

Take a look at pam_mkhomedir's usage on that page.

  • This is a problem with nss configuration, as Micheal answered, not with the PAM configuration. – theotherreceive Jun 21 '11 at 9:24
  • @theotherreceive Not necessarily. Ubuntu/Debian uses 'passwd: compat' - Additionally, if you put 'ldap' in front of files in nsswitch - local services will poll ldap before local files - inefficient. 'Compat' will defer to what's setup in the /etc/pam.d/common-* files. – thinice Jun 21 '11 at 18:34
  • 1
    +1 for the link to the debian wiki. That is a great resource. I'll definitely refer to it many times in the future. – Upgradingdave Jun 21 '11 at 21:08
  • yes necessarily. The question pretty clearly states that authentication works, therefore the problem is not with the PAM configuration, but with the nss ldap setup. – theotherreceive Jun 28 '11 at 8:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.