4

1) I have a working LDAP server which I've confirmed can be used with LDAP clients, running on ec2 via jumpbox.

2) I've run authconfig to setup ldap based authentication, to point to the server:

authconfig --useshadow --enablesssd --enablesssdauth --enablesssdauth --passalgo=sha512 --enableldap --ldapserver=my.ldap.server --ldapbasedn='ou=users,o=Directory' --enablecachecreds --enablelocauthorize --update --enableldapauth

3) However, LDAP login fails:

[root@m2 ~]# su bsmith su: user bsmith does not exist

To debug, I've tried to validate as many components of ldap as possible. HEre is some data from my client machine:

1) My /etc/nsswitch.conf appears to have ldap on the list:

passwd:     files sss ldap
shadow:     files sss ldap
group:      files sss ldap

2) Also, ive checked /etc/pam_ldap.conf, which appears to have the right contents at the end:

# SASL mechanism for PAM authentication - use is experimental
# at present and does not support password policy control
#pam_sasl_mech DIGEST-MD5
uri ldap://my.ldap.server/
ssl start_tls
tls_cacertdir /etc/openldap/cacerts
pam_password md5

How can I debug the login/authentication path in my client to figure out where the login is failing and why my client isnt able to log in?

  • 1
    Is this CentOS, Fedora or RedHat? Regardless of that, you most likely will find something related to your problem in /var/log/secure and /var/log/messages. – Sami Laine Jan 7 '14 at 10:47
  • This is on RHEL – jayunit100 Jan 7 '14 at 15:36
  • 1
    no one there to reply this ? same error facing here too using centos 6.5 – Babin Lonston Aug 31 '14 at 9:30
0

I think /var/log/secure and /var/log/messages as @sami mentioned in the above thread. Also please check this deamons are up and running "nscd and nslcd".

Please check the below config as well..!
/etc/nslcd.conf:

uid nslcd
gid ldap
# This comment prevents repeated auto-migration of settings.
uri ldap://ldap.da.com
base dc=da,dc=com
ssl start_tls
tls_cacertdir /etc/openldap/cacerts

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.