I have a working LDAP server which I've confirmed can be used with LDAP clients, running on ec2 via jumpbox.
I've run authconfig to setup ldap based authentication, to point to the server:
authconfig --useshadow --enablesssd --enablesssdauth --enablesssdauth --passalgo=sha512 --enableldap --ldapserver=my.ldap.server --ldapbasedn='ou=users,o=Directory' --enablecachecreds --enablelocauthorize --update --enableldapauth
However, LDAP login fails:
[root@m2 ~]# su bsmith
su: user bsmith does not exist
To debug, I've tried to validate as many components of ldap as possible. Here is some data from my client machine:
My
/etc/nsswitch.conf
appears to have ldap on the list:passwd: files sss ldap
shadow: files sss ldap
group: files sss ldap
Also, I've checked
/etc/pam_ldap.conf
, which appears to have the right contents at the end:# SASL mechanism for PAM authentication - use is experimental
# at present and does not support password policy control
#pam_sasl_mech DIGEST-MD5
uri ldap://my.ldap.server/
ssl start_tls
tls_cacertdir /etc/openldap/cacerts
pam_password md5
How can I debug the login/authentication path in my client to figure out where the login is failing and why my client isnt able to log in?
/var/log/secure
and/var/log/messages
.