It's tricky. You need a PAM module that performs LDAP authentication, but doesn't use the same configuration as your LDAP plugin for NSS. This is problematic because most distros assume you're using an integrated LDAP solution.
- PADL's
pam_ldap
module looks like it can be configured to use a different configuration file than the one used by PADL's LDAP plugin for NSS.
- Be advised that PADL's implementation of LDAP for NSS does not involve a daemon like
nscld
and is considered inferior for that reason.
- If your distro allows you to use nslcd and PADL's pam_ldap side by side, you can try that. (not likely) The packages are usually mutually exclusive because they provide similar functionality. Unless the NSS plugin is packaged separately, there will be a file conflict. (
libnss_ldap.so
)
- Take a look at
pam_sssd
, if your distro supplies it. I think it might be possible to use these side by side, but it relies upon sssd
and I haven't set that up before.
- Custom compile a pam_ldap implementation and configure it to use a separate configuration file. You're on your own for this. Of note, PADL's pam_ldap looks like it can be built separately from its NSS library.
- If you have a Kerberos implementation (i.e. Active Directory), you can use
pam_krb5.so
for authentication and point NSS at LDAP...but be warned that Kerberos requires its own subset of knowledge to configure correctly.
No matter what, this is going to be time consuming. You may be better off replicating the necessary data between your two LDAP servers so that you can point your server at a single one.