I've setup a LDAP system in my local network (CentOS7) and it seems to work as expected. Now I've created a user in LDAP whose username is exact the same as the username of an already existing local user on one of my LDAP clients. When I check for them on the client with like:

getent passwd | grep anakin

I get:

anakin:x:1000:1000:Anakin Skywalker:/home/anakin:/bin/bash
anakin:*:2000:1000:Anakin Skywalker:/home/anakin:/bin/bash

so I know both of them really exist. So when I login to that machine as anakin and check for my ID, it tells me:

uid=1000(anakin) gid=1000(Jedi) [...]

For me that looks like I've been logged in as the local user rather than the LDAP user. Maybe this is setup like this by default, so this is fine, but how do I change this, so I get logged in as the LDAP user before the machine checks for local users with the same username? I suppose this has something to do with pam, but actually all files in /etc/pam.d/ begin with:

# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.

I've tried to solve my problem by using authconfig --disableshadow but haven't made any progress.

Another thing is, if I have different passwords for both users with the same name, I can login with both passwords but always end up as the local user even if I used the LDAP user's password. I don't know if the authentication is really supposed to work like this.


This has nothing to do with the configuration files in /etc/pam.d, or even PAM at all.

The service you are referring to is known as Name Service Switch, (NSS); it's purpose is to query information from the different databases available, e.g., passwd, group, shadow, etc.

The order of the entries in /etc/nsswitch.conf are the order that each database will be queried.

As mdpc stated, due to network-related issues, querying users via LDAP may sometimes result in failure. However, this is where something like nscd can help.

Nscd is used to cache these database entries; which can improve performance, but may also be the cause of further confusion, i.e., if the cached user's password changes in the directory, it may take some time before it is updated locally.


I believe that the place to change this is nsswitch.conf.

However, a warning is that in the event a network problem, you might wish to have a few local accounts for recovery, what you suggest might cause some problems. So I'd still stick with passwd: local ldap and remove any overlapping accounts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.