Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to configure Ubuntu 10.04 so that I can login using ldap credentials.

I've followed these general configuration steps outlined in several tutorials I found:

1) Install libraries:

sudo apt-get install libpam-ldap libnss-ldap nss-updatedb libnss-db nscd

2) entered in the connection details when prompted by libnss_ldap

3) configured nsswitch.conf to use ldap:

passwd: files ldap
group: files ldap
shadow: files ldap

4) configured pam.d common-* files

Here's the contents of "common-auth":

auth    [success=2 default=ignore] nullok_secure
auth    [success=1 default=ignore] use_first_pass
# here's the fallback if no module succeeds
auth    requisite             
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth    required              
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config

I've tried this on 2 linux servers. Neither seems to recognize any ldap users. For example, getent passwd <ldap username> doesn't return anything. id <ldap username> returns no such user.

If I try to ssh using my ldap credential, I see this in the auth.log:

Jun  2 14:16:50 hostnameXX sshd[1527]: pam_unix(sshd:auth): check pass; user unknown
Jun  2 14:16:50 hostnameXX sshd[1527]: pam_unix(sshd:auth): authentication failure; logname=uid=0 euid=0 tty=ssh ruser= rhost=xx.xx.xx.xx


I uncommented the following in ldap.conf:

nss_base_passwd ou=xxx,dc=xxx,dc=xxx
nss_base_shadow ou=xxx,dc=xxx,dc=xxx
nss_base_group  ou=xxx,dc=xxx,dc=xxx

and now making a little progress - I'm now seeing this in the auth.log:

Jun  2 16:15:03 <hostname> sshd[1566]: pam_ldap: error trying to bind as user cn=xxxx,ou=xxx,dc=xxx,dc=xx" (Invalid credentials)
Jun  2 16:15:05 <hostname> sshd[1566]: Failed password for invalid user xxxx from xx.xx.xx.xx port xxxx ssh2

If I do an ldapsearch using the same host and base dn as specified in ldap.conf, I can query and find my ldap user account successfully.

What am I missing? Maybe some service needs to be started? Thanks much for any help.

share|improve this question
up vote 2 down vote accepted

I started nslcd in debug mode: nslcd -d and saw in the statements that it was looking for objectclass posixAccount. All the entries in my LDAP were of type inetOrgPerson. I had to include the nis.schema in the slapd.conf file, and then add posixAccount as an auxiliary objectclass to each entry. Then, I could finally use getent to see accounts inside LDAP.

Cross posted here:

share|improve this answer
Thank you so very much, I had the configuration part all set up and this simple detail was escaping me. – paulo.albuquerque Feb 23 at 21:10

Do you have pam_ldap in the pam modules? Missing that would explain the behavior.

share|improve this answer
Thanks for your help. I updated my original question to list the contents of /etc/pam.d/common-auth. As shown, it's configured to use I see that exists inside /lib/security/ Perhaps I need to do another step to 'enable' it? – Dave Paroulek Jun 2 '11 at 19:49

Our (Centos) systems use LDAP (against Active Directory). Did you set up your /etc/ldap.conf? Ours maps nss_* tags to DN's in LDAP. If you haven't done that, it's unlikely to work. Check out this openldap auth tutorial.

There is a service that may help, nscd, name service cache daemon. As the name implies, it just caches, so it's not likely to be your issue, though may help once you figure your issue out. It does get 'stuck' sometimes, and we have to bounce it when it doesn't refresh its cache properly.

share|improve this answer
Thanks, Rich. I saw several lines inside ldap.conf that were commented out. I uncommented and configured them to point to the corresponding ou's. Thanks also for the nscd suggestion. I've read the man page and tried a few things like restarting nscd service. But it just seems like nothing is even trying to connect to ldap....very strange. – Dave Paroulek Jun 2 '11 at 19:55
I'm making progress. After uncommenting the nss_* tags, I'm now seeing more encouraging output in auth.log (see my updated question) Getting closer ;-) Thanks again. – Dave Paroulek Jun 2 '11 at 20:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .