1

I am trying to get Elementary OS to allow logins of accounts on OpenLDAP but haven't succeeded and would be grateful if anyone could give me any pointers on how to troubleshoot.

The OpenLDAP server is running and has been in use for some time with Mac clients but this is the first Linux client I've tried to connect.

I think the LDAP client itself is configured correctly because if I run ldapsearch -x -LLL -H ldap://ldap.example.com -b 'dc=ldap,dc=example,dc=com' (obviously with my own domain not example.com) I get details of all the ldap users as I'd expect.

If I try to login as one of those users I get "user [user] does not exist" if I use su in Terminal or "Login incorrect" if I try from a tty session.

Instructions on configuration vary depending on distribution so I've probably missed something but in addition to LDAP itself, I've done the following: edited /etc/nsswitch.conf adding "ldap" to 3 lines which now read:

passwd:   files systemd ldap
group:    files systemd ldap
shadow:   files ldap

edited /etc/pam.d/common-password to remove "use_authtok" from the password line including pam_ldap so it now reads:

password   [success=1 user_unknown=ignore default=die] pam_ldap.so try_first_pass

edited /etc/pam.d/common-session just to create a home directory on first login.


In my original post I'd made an incorrect assumption. I thought he fact that ldapsearch returned valid results meant that LDAP itself was correctly configured but it seems that's not the case.

In /var/log/auth.log I found

systemd-sysusers: nss_ldap: could not connect to any LDAP server as [DN] - Can't contact LDAP server
systemd-sysusers: nss_ldap: failed to bind to LDAP server ldap://[IPaddress]; Can't contact LDAP server
systemd-sysusers: nss_ldap: reconnecting to LDAP server...

repeated many times before changing to

bus-daemon: nss_ldap: could not connect to any LDAP server as [DN] - Can't contact LDAP server
bus-daemon: nss_ldap: failed to bind to LDAP server ldap://[IPaddress]; Can't contact LDAP server
bus-daemon: nss_ldap: reconnecting to LDAP server...

with some intermittent

rsyslogd: nss_ldap: could not connect to any LDAP server as [DN] - Can't contact LDAP server
rsyslogd: nss_ldap: failed to bind to LDAP server ldap://[IPaddress]; Can't contact LDAP server
rsyslogd: nss_ldap: could not search LDAP server - Server is unavailable

I tried changing the configuration from ldapi to ldap as that was the protocol I used for ldapsearch which looks as if it's on the right track but has not completely fixed the problem. The systemd-sysusers, rsyslogd and dbus-daemon messages continue and similar avahi-daemon and nscd messages appear after booting but later, after lightdm starts, the nscd messages change to

nscd: nss_ldap: failed to bind to LDAP server ldap://[IPaddress]: Invalid credentials
nscd: nss_ldap: reconnecting to LDAP server

I'm now trying to find out how to insert credentials but I'd also like to know if the blocks of errors for systemd-sysusers, rsyslogd, dbus-daemon, avahi-daemon and first set of nscd errors are normal and can be ignored or if there is some separate configuration I need to do to address those.

1
  • I realised the assumption that the problem I with PAM is not correct. To avoid confusion caused by a radical re-edit I've added information in a reply below. Oct 5 at 6:36
0

The /etc/nsswitch.conf may be in error, as it should look something like this:

passwd: compat systemd ldap
group: compat systemd ldap
shadow: compat

Did you remember to enable creation of the user’s home directory on first login by editing /etc/pam.d/common-session to include:

session optional pam_mkhomedir.so skel=/etc/skel umask=077

Aside from these two points, you seem to have everything else set up correctly 🤔

2
  • Thanks for the reply. I changed "file" to "combat" in nsswitch.conf but unfortunately it makes no difference. My original post did not display the first of these three lines (there was no space between the code markup and the text) which probably mislead you. The common-session line is as you wrote. I didn't include it in my post as the process didn't seem to have got that far. Oct 2 at 23:26
  • Just noticed the mistake caused by autocorrect but not quickly enough to edit my comment. My file does contain "compat" not "combat". Oct 2 at 23:47
0

I solved the problem by removing the rootbinddn entry from ldap.conf

I had missed this because I had originally intended to bind anonymously and binddn and bindpw were not set.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.