Ubuntu 12.04 LDAP client issue

Question

I followed the guide described here configure LDAP, but I keep getting following error when running "getent passwd", is there any reason for that?

Error:

Jul 16 15:58:33 wso2-VirtualBox getent: nss_ldap: could not search LDAP server - Server is unavailable
^[[AJul 16 15:59:34 wso2-VirtualBox getent: nss_ldap: failed to bind to LDAP server ldapi:///192.168.4.152/: Invalid credentials
Jul 16 15:59:34 wso2-VirtualBox getent: nss_ldap: could not search LDAP server - Server is unavailable

Configuration files:

vi /etc/ldap.conf

base dc=example,dc=com

uri  ldapi:///192.168.4.152/

ldap_version 3

timelimit 4

bind_timelimit 4

bind_policy soft

pam_password md5

nss_initgroups_ignoreusers avahi,avahi-
autoipd,backup,bin,colord,daemon,games,gnats,hplip,irc,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,nslcd,openldap,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,sync,sys,syslog,usbmux,uucp,whoopsie,www-data

Answer 1

Use the ldapsearch command line tool to verify that the server is running and the credentials you are using are correct:

ldapsearch -D the-dn-you-use -w -the-password-you-use \
    -H 192.168.4.152:389 -s base -b dc=example,dc=com '(&)' 1.1

If ldapsearch succeeds, the server is listening, the LDAP client has sufficient permission to perform this search, and the authentication was correct.

Answer 2

I think that the problem is that:

uri  ldapi:///192.168.4.152/

should be:

uri  ldap://192.168.4.152/

Answer 3

I guess what you need to do is first determine whether your LDAP server is accepting connections at all... Install ldap-utils on your client so that you have the ldapsearch tool. Then try ldapsearch -x. This uses simple authentication and if you get results then you can be sure that your ldap server can be queried from the client.

Next, take a look at your slapd.conf file. Take a close look at the fields binddn and bindpw. You can change the bindpw if you don't remember it. The command to generate an encoded bindpw would be to use slappasswd on your simple text password. After that you can use the command mentioned by Terry Gardner above. If that connects then you can be rest assured that the ldap authentication is working fine. If it doesn't work, then post the error messages, describe the issues you faced and also post your slapd.conf and hopefully, we should be able to provide you a solution. :)

Answer 4

I used the official documentation and ended up with similar messages although getent passwd did show LDAP entries in the output. Even bash completion of user names was working with LDAP values. When I tried id username with an LDAP username it failed and logged the same error messages as yours.

After a could minutes I remembered that the LDAP data contained an administrator name of cn=admin,dn=... while in /etc/ldap.conf the rootbinddn was set to cn=mananger,dn=...
I changed /etc/ldap.conf to match the LDAP data and the issue cleared up. Later I found the blog you mentioned and it says:

Comment out the line "rootbinddn" [ not sure why we need to do that ]

It's probably the same thing.