We set up some Linux machines to use our company's LDAP server for authentication. We were then acquired by another company, and they want us to use their LDAP server and retire the old one. But the user names are not the same - the old names are now IDs. "asmith" might now be represented by "AS31328", and "asmith" doesn't appear anywhere in the record.

Is there a way I can configure the machine to allow the existing user names but map them to the correct user IDs in the new LDAP server? New users would have to use their ID instead of the old name, but existing users would still be able to use asmith/password and the mapping "asmith <-> AS31328" would point to the AS31328 user in LDAP.

Alternatively, can I rename the existing accounts so that going forward, you'd have to log in using AS31328 instead of asmith but your existing files and permissions would remain?

  • What are you using for the LDAP authentication? pam_ldap? – voretaq7 May 30 '13 at 18:39
  • Yes, it's pam_ldap. – Scott Matthews May 30 '13 at 18:56

You should really rename your accounts to conform to your new company's naming convention (whatever that may be). You can rename accounts on unix systems to your heart's content as long as the UID and GID NUMBERS do not change (the name is a convenient label - the numeric ID is what gets used for all internal checks).

Ideally you should migrate to using the new company's LDAP directory, and add the appropriate RFC 2307 attributes to the objects in that directory so your unix systems can authenticate against it.

In terms of migration and renaming, pam_ldap defaults to using the RFC 2307 compliant uid attribute for determining a user's login name.
As long as the UID attribute (and other relevant details like uidNumber and gidNumber match your old system's configuration you can switch to the new LDAP server no noticeable impact.

If the uid attribute is different in the new environment and cannot be changed you can extend your LDAP schema to include some other attribute (like cn) which does match the old login names and configure pam_ldap to use that attribute via the pam_login_attribute configuration directive.

If you go this route it is important that the entire merged company standardize on an attribute and naming scheme to use for Unix accounts. Having a mixed environment where some machines use uid, others use cn, and still others use unixUserName or some other custom attribute will just lead to headaches.

| improve this answer | |
  • Yeah, not gonna happen. The new company is huge - many thousands of people - and they're not going to change their global LDAP schema for the convenience of a handful of developers. Thanks anyway – Scott Matthews May 30 '13 at 20:04
  • That's a political problem - Server Fault only does technical problems. (Should you be feeling masochistic and want advice on how to fight the political problem, we do have The Workplace - but my experience is that if you can't convince your boss to convince their boss to convince etc. you're pretty much out of luck.) – voretaq7 May 30 '13 at 21:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.