Troubleshooting logins for LDAP accounts

Question

I am trying to get Elementary OS to allow logins of accounts on OpenLDAP but haven't succeeded and would be grateful if anyone could give me any pointers on how to troubleshoot.

The OpenLDAP server is running and has been in use for some time with Mac clients but this is the first Linux client I've tried to connect.

I think the LDAP client itself is configured correctly because if I run ldapsearch -x -LLL -H ldap://ldap.example.com -b 'dc=ldap,dc=example,dc=com' (obviously with my own domain not example.com) I get details of all the ldap users as I'd expect.

If I try to login as one of those users I get "user [user] does not exist" if I use su in Terminal or "Login incorrect" if I try from a tty session.

Instructions on configuration vary depending on distribution so I've probably missed something but in addition to LDAP itself, I've done the following: edited /etc/nsswitch.conf adding "ldap" to 3 lines which now read:

passwd:   files systemd ldap
group:    files systemd ldap
shadow:   files ldap

edited /etc/pam.d/common-password to remove "use_authtok" from the password line including pam_ldap so it now reads:

password   [success=1 user_unknown=ignore default=die] pam_ldap.so try_first_pass

edited /etc/pam.d/common-session just to create a home directory on first login.

---

In my original post I'd made an incorrect assumption. I thought he fact that ldapsearch returned valid results meant that LDAP itself was correctly configured but it seems that's not the case.

In /var/log/auth.log I found

systemd-sysusers: nss_ldap: could not connect to any LDAP server as [DN] - Can't contact LDAP server
systemd-sysusers: nss_ldap: failed to bind to LDAP server ldap://[IPaddress]; Can't contact LDAP server
systemd-sysusers: nss_ldap: reconnecting to LDAP server...

repeated many times before changing to

bus-daemon: nss_ldap: could not connect to any LDAP server as [DN] - Can't contact LDAP server
bus-daemon: nss_ldap: failed to bind to LDAP server ldap://[IPaddress]; Can't contact LDAP server
bus-daemon: nss_ldap: reconnecting to LDAP server...

with some intermittent

rsyslogd: nss_ldap: could not connect to any LDAP server as [DN] - Can't contact LDAP server
rsyslogd: nss_ldap: failed to bind to LDAP server ldap://[IPaddress]; Can't contact LDAP server
rsyslogd: nss_ldap: could not search LDAP server - Server is unavailable

I tried changing the configuration from ldapi to ldap as that was the protocol I used for ldapsearch which looks as if it's on the right track but has not completely fixed the problem. The systemd-sysusers, rsyslogd and dbus-daemon messages continue and similar avahi-daemon and nscd messages appear after booting but later, after lightdm starts, the nscd messages change to

nscd: nss_ldap: failed to bind to LDAP server ldap://[IPaddress]: Invalid credentials
nscd: nss_ldap: reconnecting to LDAP server

I'm now trying to find out how to insert credentials but I'd also like to know if the blocks of errors for systemd-sysusers, rsyslogd, dbus-daemon, avahi-daemon and first set of nscd errors are normal and can be ignored or if there is some separate configuration I need to do to address those.

Answer 1

The /etc/nsswitch.conf may be in error, as it should look something like this:

passwd: compat systemd ldap
group: compat systemd ldap
shadow: compat

Did you remember to enable creation of the user’s home directory on first login by editing /etc/pam.d/common-session to include:

session optional pam_mkhomedir.so skel=/etc/skel umask=077

Aside from these two points, you seem to have everything else set up correctly 🤔

Answer 2

I solved the problem by removing the rootbinddn entry from ldap.conf

I had missed this because I had originally intended to bind anonymously and binddn and bindpw were not set.