SASL/GSSAPI needs Kerberos authentication against the LDAP server with proxy authorization if using LDAP authentication with nss-pam-ldapd on a Debian Buster operating system. I try to configure this on my Raspberry Pis to have single sign on but cannot get it to work.
I have my ldap server configured with How to setup SASL Proxy Authorization with an OpenLDAP server on Debian. I named the proxy user anyuser so its distinguished name is
According to LDAP authentication with nss-pam-ldapd on a Debian system I have to install packages
libpam-ldapd in addition to the GSSAPI plugin
libsasl2-modules-gssapi-mit. But I will use
libpam-krb5 instead of
rpi ~$ sudo apt install libsasl2-modules-gssapi-mit libnss-ldapd ldap-utils
On installation it was presented a configuration dialog that settings are stored in
/etc/nsswitch.conf. I have to configure again with
rpi ~$ sudo dpkg-reconfigure nslcd rpi ~$ sudo dpkg-reconfigure libnss-ldapd
My settings given from the dialogs are:
rpi ~$ sudo cat /etc/nslcd.conf # /etc/nslcd.conf # nslcd configuration file. See nslcd.conf(5) # for details. # The user and group nslcd should run as. uid nslcd gid nslcd # The location at which the LDAP server(s) should be reachable. uri ldap://kdc-master.home.hoeft-online.de # The search base that will be used for all queries. base ou=home,dc=hoeft-online,dc=de # The LDAP protocol version to use. #ldap_version 3 # The DN to bind with for normal lookups. #binddn cn=annonymous,dc=example,dc=net #bindpw secret # The DN used for password modifications by root. #rootpwmoddn cn=admin,dc=example,dc=com # SSL options #ssl off #tls_reqcert never tls_cacertfile /etc/ssl/certs/ca-certificates.crt # The search scope. #scope sub sasl_mech GSSAPI krb5_ccname /var/run/nslcd/nslcd.tkt sasl_authzid dn:uid=anyuser,ou=people,ou=home,dc=hoeft-online,dc=de
~$ cat /etc/nsswitch.conf # /etc/nsswitch.conf # # Example configuration of GNU Name Service Switch functionality. # If you have the `glibc-doc-reference' and `info' packages installed, try: # `info libc "Name Service Switch"' for information about this file. passwd: files ldap group: files ldap shadow: files ldap gshadow: files hosts: files dns networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis
getent passwd I expect to get the credentials of ingo from the LDAP server. It isn't stored in local
/etc/passwd. But I only get the local entries from
/etc/passwd. In the logs of the LDAP server I can see that there is no attempt to BIND to anyuser. What I'm missing here?
getent does not get credentials from the LDAP server?