I have installed openldap on centos 7 minimum and added a user newuser01 to the database successfuly. ldapsearch works fine with both the master and the client using this format:
ldapsearch -H ldaps://provider.example.com -x -D "cn=Manager,dc=example,dc=com" -W

But getent passwd -s sss newuser01 or getent passwd newuer01 returns nothing on both client and master.

Here are the files that I looked at, I am not sure if they are correctly configured and if there are others I should look at, thank you so much for your efforts:

  • /etc/nsswitch.conf /etc/openldap/ldap.conf
  • /etc/sssd/sssd.conf
  • /etc/openldap/slapd.conf # It is deprecated for centos 7
  • /etc/pam.d/system-auth

On Master:

/etc/nsswitch.conf contains:

passwd:     files sss
shadow:     files sss
group:      files sss
hosts:      files dns 
bootparams: nisplus [NOTFOUND=return] files
ethers:     files
netmasks:   files
networks:   files
protocols:  files
rpc:        files
services:   files sss
netgroup:   files sss
publickey:  nisplus
automount:  files
aliases:    files nisplus

/etc/openldap/ldap.conf contains:

BASE            dc=example,dc=com
URI             ldaps://provider.example.com
TLS_CACERTDIR   /etc/openldap/certs
TLS_REQCERT     demand

/etc/sssd/sssd.conf is empty on the server

/etc/pam.d/system-auth contains:

auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 1000 quiet_success
auth        required      pam_deny.so
account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 1000 quiet
account     required      pam_permit.so
password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    required      pam_deny.so
session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
-session     optional      pam_systemd.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so

On the client:

/etc/nsswitch.conf contains exactly as the server

/etc/openldap/ldap.conf contains:

TLS_CACERTDIR /etc/openldap/cacerts
# Turning this off breaks GSSAPI used with krb5 when rdns = false
URI ldaps://provider.example.com:636
BASE dc=example,dc=com

/etc/sssd/sssd.conf contains:

autofs_provider = ldap
cache_credentials = False
ldap_search_base = dc=example,dc=com
krb5_server = #
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_uri = ldaps://provider.example.com:636
ldap_id_use_start_tls = False
ldap_tls_cacertdir = /etc/openldap/cacerts
services = nss, pam, autofs
config_file_version = 2
domains = default
homedir_substring = /home

/etc/pam.d/system-auth seems to contain what the server does with this extra entry:

session     optional      pam_sss.so
  • Are you authenticating with a kerberos system or just local? – Victor Vidal Jun 21 '16 at 16:31
  • I have made self certificates, but do not know anything about Kerberos system. – kevbuntu Jun 21 '16 at 17:21
  • I neglected to mention that I am running all these on Virtual box and both client and server are VM machines. – kevbuntu Jun 21 '16 at 17:59
  • Is there a reason you are using sss as a nss module instead of nss_ldap? I am not sure if sss is actually a valid nss module or not. – cstamas Jun 21 '16 at 18:25
  • This authconfig I run on the client but no the server – kevbuntu Jun 21 '16 at 18:42

this works for me using sssd-ldap against a freeipa ldap server (not using the built-in idm provider but the sssd-ldap provider as asked).

  • install sssd-ldap and authoconfig
  • run authconfig --enablesssd --enablesssdauth --enablelocauthorize --update
  • create the configuration file /etc/sssd/sssd.conf with your appropriate information:

autofs_provider = ldap
ldap_schema = rfc2307bis
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_uri = ldap://your.ldap.host
ldap_id_use_start_tls = True
cache_credentials = True
ldap_tls_cacertdir = /etc/pki/tls/certs
ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt
ldap_default_bind_dn = uid=user1,cn=users,cn=accounts,dc=your,dc=domain,dc=tld
ldap_default_authtok_type = password
ldap_default_authtok = secretpassword
ldap_user_search_base = cn=users,cn=accounts,dc=your,dc=domain,dc=tld
ldap_group_search_base = cn=groups,cn=accounts,dc=your,dc=domain,dc=tld

services = nss, pam, autofs
config_file_version = 2

domains = default
homedir_substring = /home






  • restart the sssd service: systemctl restart sssd
  • verify that sss is enabled in nsswitch.conf for passwd, groups and shadow. Do not use ldap in nsswitch.conf, it should be "files sss", not "files ldap"

If you do not need binding to get the list of users remove the ldap_default_bind_dn, ldap_default_authtok_type and ldap_default_authtok directives. If you do not require tls, remove those but you are authenticating users, so it should be enabled. Modify the paths to the cacertdir and cacert directives to match your situation, as the user and group search base.

In this blog: http://www.couyon.net/blog/enabling-ldap-usergroup-support-and-authentication-in-centos-6 you will find a similar howto. The official Red Hat documantation is here: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/Configuring_Domains.html#Configuring_Domains-Configuring_a_Native_LDAP_Domain

As always, the proof is in the pudding:

[root@localhost sssd]# grep user1 /etc/passwd
[root@localhost sssd]# getent passwd user1
user1:*:1076200004:1076200004:ipa user:/home/user1:/bin/sh
  • Thanks very much, I will have to do a clean server and client as my changes have messed things up. But I have a couple of questions: all these changes to be done on the client I take it, but what changes need to be done on the provider to activate getent passwd? I also have "--disableldaptls" is this correct or should this be --enableldaptls? Is the password your actual password or the encrypted one? Thanks again – kevbuntu Jun 22 '16 at 12:57
  • all those settings are in the client. Please take a look a the man pages of man sssd-ldap to see what the options mean – natxo asenjo Jun 22 '16 at 12:59
  • inside my sssd.conf I have: – kevbuntu Jun 22 '16 at 18:12
  • ldap_tls_cacertdir = /etc/openldap/cacerts while you have: ldap_tls_cacertdir = /etc/pki/tls/certs. I have the file ca.crt and ofcourse there is there is the file ca-bundle.crt not sure which to use? – kevbuntu Jun 22 '16 at 18:13
  • It is not working. Is there a way I could paste my sssd.conf file the comment field does not allow it. ldapsearch ldaps:/// works fine. I made it as you suggested and only used authconfig and only touched sssd.conf manually – kevbuntu Jun 22 '16 at 18:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.