We have an (active directory) LDAP server and I'm trying to use libnss-ldap to resolve ldap users and groups. When I run 'getent passwd', all of the users are returned exactly like I'd expect. However, when I run 'getent group' all of the system groups are returned immediately and then the process hangs and then seems to give up.
/etc/nsswitch.conf:
passwd: compat ldap
group: compat ldap
shadow: compat ldap
hosts: files dns
networks: files
protocols: db files
services: db files
ethers: db files
rpc: db files
netgroup: nis
/etc/libnss-ldap.conf:
host 1.1.1.2 1.1.1.3
base DC=ad,DC=domain,DC=tld
binddn CN=pamldap,OU=Service Accounts,OU=GSS,DC=ad,DC=domain,DC=tld
bindpw somepass
uri ldap://ad.domain.tld/
ldap_version 3
nss_paged_results yes
pagesize 10000
nss_base_passwd OU=Users,OU=GSS,DC=ad,DC=domain,DC=tld
nss_base_shadow OU=Users,OU=GSS,DC=ad,DC=domain,DC=tld
nss_base_group OU=Centers,OU=Groups,OU=GSS,DC=ad,DC=domain,DC=tld
nss_map_objectclass posixAccount user
nss_map_objectclass shadowAccount user
nss_map_attribute uid sAMAccountName
nss_map_attribute homeDirectory unixHomeDirectory
nss_map_attribute shadowLastChange pwdLastSet
nss_map_objectclass posixGroup group
nss_map_attribute uniqueMember member
pam_login_attribute sAMAccountName
pam_filter objectclass=User
pam_password ad
/etc/ldap/ldap.conf:
BASE OU=GSS,DC=ad,DC=domain,DC=tld
URI ldap://ad.domain.tld
TLS_CACERT /etc/ssl/certs/ca-certificates.crt
I looked through everything I could find and wasn't able to find anything with the same issue. Hopefully someone can slap me in the face with something really obvious and trivial that I'm doing wrong.
