Ubuntu Landscape - LDAP authentification

Question

We want to implement an LDAP authentication on our Landscape server. The landscape documentation says, that its possible but we didn't find any solution.

Answer 1

LDAP functionality can only be enabled during the Landscape server install process and not at a later stage. Below are instructions on how to complete that with current latest Ubuntu LTS 16.04 and landscape server version 17.03.

1. Lets tart by Installing Pluggable Authentication Module for LDAP.

   sudo apt install libpam-ldap
   

2. We need to modify /etc/ldap.conf accordingly to your needs/setup/requirements.

   vim /etc/ldap.conf
   

   and add following config, changing whats needed

   base OU=XX,DC=XX,DC=XX
   uri ldap://ip.of.ldap.server
   ldap_version 3
   # we need an authenticated user to search the directory 
   binddn CN=<your user>,OU=XX,DC=XX,DC=XX
   bindpw <above password>
   scope one
   pam_filter objectclass=person
   pam_login_attribute userPrincipalName
   pam_password ad
   ssl off
   

3. In order to activate the pam plugin, create /etc/pam.d/landscape file with below lines:

   vim /etc/pam.d/landscape
   

   and paste

   #%PAM-1.0
   auth    required pam_ldap.so
   account required pam_ldap.so
   

4. Navigate over to the root URL for your Landscape installation and create your administrator. You will notice that an Identity field will appear. This will match the pam_login_attribute specified in your ldap.conf.

Answer 2

I couldn't figure out why this was not working even though my ldap/pam setup was good, I kept getting this error:

Nov 17 15:36:28 hostname python[31175]: pam_ldap: missing file "/etc/ldap.conf"                                                                                
Nov 17 15:36:28 hostname python[31175]: pam_ldap: missing file "/etc/ldap.conf"  

I then realised that the landscape service is running as "landscape" user and the /etc/ldap.conf permissions did not allow landscape to access it.

I reset the permissions like this to allow group RW access

root@hostname:/opt/canonical/landscape# chmod  0770  /etc/ldap
root@hostname:/opt/canonical/landscape# chgrp -R landscape  /etc/ldap
root@hostname:/opt/canonical/landscape# chmod  0660  /etc/ldap/ldap*

and I can now authenticate onto landscape using AD credentials.

Also Note that I chose these values for my ldap.conf

pam_login_attribute sAMAccountName
pam_filter objectclass=User
pam_password ad

and I have a symlink like this for ldap.conf

lrwxrwxrwx 1 root root 19 Nov 17 12:37 /etc/ldap.conf -> /etc/ldap/ldap.conf