I have SSH/LDAP working just fine with public keys and all on an AWS Linux instance. I'm using nss-pam-ldapd and pam_ldap. But when I set /etc/pam_ldap.conf as follows to restrict login to a LDAP group:
pam_groupdn cn=Administrators,ou=groups,dc=domain,dc=com pam_member_attribute memberUid
The LDAP user is then not allowed to log in. Local accounts can log in just fine and LDAP accounts can log in if the pam_groupdn line is commented out.
The only logged item is from sshd: Access denied by PAM account configuration.
Here are the pertinent lines from /etc/pam.d/system-auth
account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so
Does anyone have any insight into what is happening here?