Ubuntu – LDAP client on Ubuntu 14.04 LTS server

ldapUbuntu

I am setting up an LDAP client on Ubuntu 14.04 server and can't seem to be able to logon. I see an error in the auth.log that says unknown user.

I installed packages:

ldap-auth-client
ldap-auth-config
libldap-2.4-2
libnss-ldap
libpam-ldap

I modified /etc/ldap.conf with my URI and base. I also modified /etc/nsswitch.conf to include ldap in passwd, group, and shadow. I can successfully ping the URI. I have setup gerrit on another system to use LDAP using the same setting as in ldap.conf.

What am I missing?

Best Answer

Since you don't post any of your configuration, it is hard to guess, but going from the error message you provided, it seems you are trying to login as an unknown user. Check, if your're using the right LDAP-String.

So maybe this can help you: How can I figure out my LDAP connection string?

Related Solutions

Ldap – Securing userPassword access with OpenLDAP in RHEL

pam_ldap shouldn't be attempting to read the userPassword value to log you in -- It logs you in by doing an LDAP bind with the DN that it retrieves.

It's possible the search parameters pam_ldap uses are over-broad & it tries to pull userPassword as a result, but if your ACL is set up correctly (looks fine to me) it won't get that value in its results.

Just in case your ACLs aren't fine (I've been known to miss stupidly obvious stuff before), here's the working ACL list from my production LDAP environment :)

# Access and Security Restrictions
# (Most restrictive entries first)
access to attrs=userPassword
    by self write
    by dn.sub="ou=sync,dc=mydomain,dc=com" read
    by anonymous auth
by users none

access to * by * read

The trailing access to * by * read is important, I didn't see it in your examples so I'm not sure if it's missing or just omitted from your snippet.

The sync line is for my LDAP synchronization service and isn't necessary if you're not doing replication...

Redhat – passwd for ldap users

Are you using Kerberos or Samba winbind at all? Or are you just trying straight LDAP?

If the latter, your /etc/ldap.conf file should have a series of 'pam_*' parameters that seem to be missing. In particular 'pam_password ad' is necessary to specify ADSI as the password change protocol. You may also need 'pam_login_attribute sAMAccountName' (+ others)

Personally I've always just bound the Linux machine using winbind, then changing passwords is as done with 'net ads password'

Best Answer

Related Solutions

Ldap – Securing userPassword access with OpenLDAP in RHEL

Redhat – passwd for ldap users

Related Topic