0

I have configured openldap with back-sql on ubuntu 18.04 but unable to login with ldapusers on client machine (centos 7). I am able to fetch user details using ldapsearch command on client machine but login is not happening. I am getting "User does not exists" error while login.

Please find the below output of ldapsearch command.

[root@ldapclient ~]# ldapsearch -x -b "dc=mobilewaretech,dc=com"
# extended LDIF
#
# LDAPv3
# base <dc=mobilewaretech,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# mrugesh, mobilewaretech.com
dn: cn=mrugesh,dc=mobilewaretech,dc=com
objectClass: inetOrgPerson
seeAlso: documentTitle=book1,dc=mobilewaretech,dc=com
seeAlso: documentTitle=book2,dc=mobilewaretech,dc=com
givenName: mrugesh
userPassword:: cXdlcnR5MTIz
telephoneNumber: 222-3234
telephoneNumber: 332-2334

# amey, mobilewaretech.com
dn: cn=amey,dc=mobilewaretech,dc=com
objectClass: inetOrgPerson
seeAlso: documentTitle=book1,dc=mobilewaretech,dc=com
givenName: amey
userPassword:: YW1leQ==
telephoneNumber: 545-4563

# Kishor Toraskar, mobilewaretech.com
dn: cn=Kishor Toraskar,dc=mobilewaretech,dc=com
objectClass: inetOrgPerson
objectClass: pkiUser
cn: Kishor Toraskar
sn: Toraskar
givenName: Kishor
userCertificate;binary:: MIIDazCCAtSgAwIBAgIBAjANBgkqhkiG9w0BAQQFADB3MQswCQYDV
 QQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEfMB0GA1UEChMWT3BlbkxEQVAgRXhhbXBsZSwgTH
 RkLjETMBEGA1UEAxMKRXhhbXBsZSBDQTEdMBsGCSqGSIb3DQEJARYOY2FAZXhhbXBsZS5jb20wHhc
 NMDMxMDE3MTYzMzE5WhcNMDQxMDE2MTYzMzE5WjB+MQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2Fs
 aWZvcm5pYTEfMB0GA1UEChMWT3BlbkxEQVAgRXhhbXBsZSwgTHRkLjEYMBYGA1UEAxMPVXJzdWxhI
 EhhbXBzdGVyMR8wHQYJKoZIhvcNAQkBFhB1aGFtQGV4YW1wbGUuY29tMIGfMA0GCSqGSIb3DQEBAQ
 UAA4GNADCBiQKBgQDuxgp5ELV9LmhxWMpV7qc4028QQT3+zzFDXhruuXE7ji2n3S3ea8bOwDtJh+q
 nsDe561DhHHHlgIjMKCiDEizYMpxvJPYEXmvp0huRkMgpKZgmel95BSkt6TYmJ0erS3aoimOHLEFi
 mmnTLolNRMiWqNBvqwobx940PGwUWEePKQIDAQABo4H/MIH8MAkGA1UdEwQCMAAwLAYJYIZIAYb4Q
 gENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1UdDgQWBBSjI94TbBmuDEeUUO
 iC37EK0Uf0XjCBoQYDVR0jBIGZMIGWgBRLbyEaNiTSkPlDsFNHLX3hwOaYI6F7pHkwdzELMAkGA1U
 EBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExHzAdBgNVBAoTFk9wZW5MREFQIEV4YW1wbGUsIEx0
 ZC4xEzARBgNVBAMTCkV4YW1wbGUgQ0ExHTAbBgkqhkiG9w0BCQEWDmNhQGV4YW1wbGUuY29tggEAM
 A0GCSqGSIb3DQEBBAUAA4GBAIgUcARb3OlWYNbmr1nmqESuxLn16uqI1Ot6WkcICvpkdQ+Bo+R9AP
 05xpoXocZtKdNvBu3FNxB/jFkiOcLU2lX7Px1Ijnsjh60qVRy9HOsHCungIKlGcnXLKHmKu0y//5j
 ds/HnaJsGcHI5JRG7CBJbW+wrwge3trJ1xHJI8prN

# book1, mobilewaretech.com
dn: documentTitle=book1,dc=mobilewaretech,dc=com
objectClass: document
description: abstract1
documentTitle: book1
documentAuthor: cn=amey,dc=mobilewaretech,dc=com
documentAuthor: cn=mrugesh,dc=mobilewaretech,dc=com
documentIdentifier: document 1

# book2, mobilewaretech.com
dn: documentTitle=book2,dc=mobilewaretech,dc=com
objectClass: document
description: abstract2
documentTitle: book2
documentAuthor: cn=mrugesh,dc=mobilewaretech,dc=com
documentIdentifier: document 2

# mobilewaretech.com
dn: dc=mobilewaretech,dc=com
objectClass: organization
objectClass: dcObject
o: Mobileware
dc: mobileware

# search reference
ref: ldap://localhost:389/dc=mobilewaretech,dc=com??sub

# search result
search: 2
result: 0 Success

# numResponses: 8
# numEntries: 6
# numReferences: 1

I have referred this https://gist.github.com/mahirrudin/9b7754e54f1e8e532049484864beba42 URL for configuring the openldap server with back-sql. Here's my nsswitch.conf file from client machine.

#
# /etc/nsswitch.conf
#
# An example Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
#
# The entry '[NOTFOUND=return]' means that the search for an
# entry should stop if the search in the previous entry turned
# up nothing. Note that if the search failed due to some other reason
# (like no NIS server responding) then the search continues with the
# next entry.
#
# Valid entries include:
#
#       nisplus                 Use NIS+ (NIS version 3)
#       nis                     Use NIS (NIS version 2), also called YP
#       dns                     Use DNS (Domain Name Service)
#       files                   Use the local files
#       db                      Use the local database (.db) files
#       compat                  Use NIS on compat mode
#       hesiod                  Use Hesiod for user lookups
#       [NOTFOUND=return]       Stop searching if not found so far
#

# To use db, put the "db" in front of "files" for entries you want to be
# looked up first in the databases
#
# Example:
#passwd:    db files nisplus nis
#shadow:    db files nisplus nis
#group:     db files nisplus nis

passwd:     mysql files sss
shadow:     mysql files sss
group:      mysql files sss
#initgroups: files sss

#hosts:     db files nisplus nis dns
hosts:      files dns myhostname

# Example - obey only what nisplus tells us...
#services:   nisplus [NOTFOUND=return] files
#networks:   nisplus [NOTFOUND=return] files
#protocols:  nisplus [NOTFOUND=return] files
#rpc:        nisplus [NOTFOUND=return] files
#ethers:     nisplus [NOTFOUND=return] files
#netmasks:   nisplus [NOTFOUND=return] files

bootparams: nisplus [NOTFOUND=return] files

ethers:     files
netmasks:   files
networks:   files
protocols:  files
rpc:        files
services:   files sss

netgroup:   files sss

publickey:  nisplus

automount:  files sss
aliases:    files nisplus

Please find nslcd.conf file.

This is the configuration file for the LDAP nameservice

switch library's nslcd daemon. It configures the mapping

between NSS names (see /etc/nsswitch.conf) and LDAP

information in the directory.

See the manual page nslcd.conf(5) for more information.

The user and group nslcd should run as.

uid nslcd gid ldap

The uri pointing to the LDAP server to use for name lookups.

Multiple entries may be specified. The address that is used

here should be resolvable without using LDAP (obviously).

uri ldap://127.0.0.1/

uri ldaps://127.0.0.1/

uri ldapi://%2fvar%2frun%2fldapi_sock/

Note: %2f encodes the '/' used as directory separator

uri ldap://192.168.0.227:389/

The LDAP version to use (defaults to 3

if supported by client library)

ldap_version 3

The distinguished name of the search base.

base dc=mobilewaretech,dc=com

The distinguished name to bind to the server with.

Optional: default is to bind anonymously.

binddn cn=proxyuser,dc=example,dc=com

The credentials to bind with.

Optional: default is no credentials.

Note that if you set a bindpw you should check the permissions of this file.

bindpw secret

The distinguished name to perform password modifications by root by.

rootpwmoddn cn=admin,dc=example,dc=com

The default search scope.

scope sub

scope one

scope base

Customize certain database lookups.

base group ou=Groups,dc=example,dc=com

base passwd ou=People,dc=example,dc=com

base shadow ou=People,dc=example,dc=com

scope group onelevel

scope hosts sub

Bind/connect timelimit.

bind_timelimit 30

Search timelimit.

timelimit 30

Idle timelimit. nslcd will close connections if the

server has not been contacted for the number of seconds.

idle_timelimit 3600

Use StartTLS without verifying the server certificate.

ssl start_tls

tls_reqcert never

CA certificates for server certificate verification

tls_cacertdir /etc/ssl/certs

tls_cacertfile /etc/ssl/ca.cert

Seed the PRNG if /dev/urandom is not provided

tls_randfile /var/run/egd-pool

SSL cipher suite

See man ciphers for syntax

tls_ciphers TLSv1

Client certificate and key

Use these, if your server requires client authentication.

tls_cert

tls_key

Mappings for Services for UNIX 3.5

filter passwd (objectClass=User)

map passwd uid msSFU30Name

map passwd userPassword msSFU30Password

map passwd homeDirectory msSFU30HomeDirectory

map passwd homeDirectory msSFUHomeDirectory

filter shadow (objectClass=User)

map shadow uid msSFU30Name

map shadow userPassword msSFU30Password

filter group (objectClass=Group)

map group member msSFU30PosixMember

Mappings for Services for UNIX 2.0

filter passwd (objectClass=User)

map passwd uid msSFUName

map passwd userPassword msSFUPassword

map passwd homeDirectory msSFUHomeDirectory

map passwd gecos msSFUName

filter shadow (objectClass=User)

map shadow uid msSFUName

map shadow userPassword msSFUPassword

map shadow shadowLastChange pwdLastSet

filter group (objectClass=Group)

map group member posixMember

Mappings for Active Directory

pagesize 1000

referrals off

idle_timelimit 800

filter passwd (&(objectClass=user)(!(objectClass=computer))(uidNumber=)(unixHomeDirectory=))

map passwd uid sAMAccountName

map passwd homeDirectory unixHomeDirectory

map passwd gecos displayName

filter shadow (&(objectClass=user)(!(objectClass=computer))(uidNumber=)(unixHomeDirectory=))

map shadow uid sAMAccountName

map shadow shadowLastChange pwdLastSet

filter group (objectClass=group)

Alternative mappings for Active Directory

(replace the SIDs in the objectSid mappings with the value for your domain)

pagesize 1000

referrals off

idle_timelimit 800

filter passwd (&(objectClass=user)(objectClass=person)(!(objectClass=computer)))

map passwd uid cn

map passwd uidNumber objectSid:S-1-5-21-3623811015-3361044348-30300820

map passwd gidNumber objectSid:S-1-5-21-3623811015-3361044348-30300820

map passwd homeDirectory "/home/$cn"

map passwd gecos displayName

map passwd loginShell "/bin/bash"

filter group (|(objectClass=group)(objectClass=person))

map group gidNumber objectSid:S-1-5-21-3623811015-3361044348-30300820

Mappings for AIX SecureWay

filter passwd (objectClass=aixAccount)

map passwd uid userName

map passwd userPassword passwordChar

map passwd uidNumber uid

map passwd gidNumber gid

filter group (objectClass=aixAccessGroup)

map group cn groupName

map group gidNumber gid

This comment prevents repeated auto-migration of settings.

ssl no tls_cacertdir /etc/openldap/cacerts

closed as off-topic by Gerald Schneider, Thomas, yoonix, Tommiie, Jenny D Jun 16 at 9:22

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Please provide your configuration for ldap login on your client. – Gerald Schneider Jun 6 at 11:41
  • [root@ldapclient ~]# cat /etc/nslcd.conf # This is the configuration file for the LDAP nameservice # switch library's nslcd daemon. It configures the mapping # between NSS names (see /etc/nsswitch.conf) and LDAP # The user and group nslcd should run as. uid nslcd gid ldap uri ldap://192.168.0.227:389/ # The LDAP version to use (defaults to 3 # if supported by client library) #ldap_version 3 # The distinguished name of the search base. base dc=mobilewaretech,dc=com – Mrugesh Acharya Jun 7 at 5:24
  • Please don't add further information in comments, it's unreadable here. Edit your question instead. Log entries from your login attempts are also useful. – Gerald Schneider Jun 7 at 5:45
  • @GeraldSchneider I'm sorry. I am a new user so I was not aware. Will take care in future. Thanks! – Mrugesh Acharya Jun 7 at 6:04
  • @GeraldSchneider Please help. – Mrugesh Acharya Jun 13 at 7:54
1

These users lack necessary fields for being able to log in.

uidNumber:
gidNumber:
loginShell:
homeDirectory:
userPassword:

This attributes are a standard part of objectClass: posixAccount.

Also, you should look to your /etc/nsswitch.conf as is it may not have ldap as a source.

  • I have added the contents of /etc/nsswitch.conf file in question. Please check. – Mrugesh Acharya Jun 11 at 11:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.