We are hosting LDAP on a Solaris server and using 150 Solaris clients and 50 Linux clients. Users and groups have a list of netgroups (server hostnames) that they are able to access. This means that a user apacheman01 can only access specific servers via SSH with his username/password. So far this works all well.
ldap.conf:
[root@tst-01 ~]# cat /etc/openldap/ldap.conf
TLS_CACERTDIR /etc/openldap/cacerts
URI ldap://ldap1.tst.domain.tld ldap://ldap2.tst.domain.tld
BASE dc=tst,dc=domain,dc=tld
These commands however show all users and groups available on the LDAP server and not only the users that have access on this server. This also means that when a user is logged in, it can "su -" to another user that shouldn't even have access on the server.
getent passwd
getent group
So LDAP authentication works as it should for initial LDAP SSH authentication, but getent passwd/group shouldn't list ALL users/groups on the LDAP, but only to the servers/netgroups that are assigned to these users/groups.