0

Just tried switching from Linux Mint to Ubuntu 18.10 but encountered numerous problems with accounts. All the steps to recreate are below in details.

I would love to know how Ubuntu 18.10 differentiates the Locally created users compared to the ones on LDAP server and why so many features are broken for LDAP users.

Problems:

  1. LDAP accounts cannot be logged in using the default gdm3 display manager. Upon setting up LDAP using method described below, you can login as the user in the terminal no problem, but you are unable to login via gdm3. If you try it instantly kicks you out back onto lock screen. Users created locally via the interface have no such problems. Switching to lightdm lets you login with LDAP account.
  2. Local admin accounts can use GUI admin elements, such as the unlock button in "Settings - Users", same unlock button in "Printers" and throughout the interface. On the other hand, LDAP account don't have the policy to use the GUI admin elements, even if added to sudoers via visudo and added to all relevant lines in /etc/groups. This probably has something to do with polkit but I don't know how to modify and fix the issue. I tried following these steps from 2012 but to no avail.
  3. LDAP accounts suffer from some broken features, for example: GUI buttons to restart/shut down don't work and there are no Sound devices recognised and restarting/installing pavucontrol does not help. It gives you a permissions error even if used with sudo (shouldn't be needed/used). Printers don't work by default either.

The way to reproduce:

Fresh clean install of Ubuntu 18.10

Set up LDAP by:

sudo apt-get install libnss-ldap libpam-ldap

Edit the /etc/nsswitch.conf file and add ldap to the passwd, group and shadow lines

Edit the /etc/pam.d/common-session file to add the following line

session required pam_mkhomedir.so skel=/etc/skel umask=0022

Open terminal and try to switch to different user (LDAP). It should work.

Using ubuntu interface, log out and try login with the same user (LDAP), it shouldn't work and should boot-loop.

Log back in using normal 'Local' admin account and switch to lightdm with:

sudo apt install lightdm

To be able to actually log-in with a LDAP username, create /etc/lightdm/lightdm.conf and add

[Seat:*]
allow-guest=true
greeter-show-manual-login=true

Restart the machine and log in using LDAP account.

See that the problems described above are present. Then try fixing them by adding the LDAP user to sudoer and relevant groups.

0

I've been working with gdm3 on Ubuntu 18.04 and encountered a similar problem. In /etc/pam.d/common-session we had the following. We had copied it from our 16.04 setup.

session sufficient pam_krb5.so session required pam_unix.so session optional pam_systemd.so

For 18.04, the pam_krb5 line should be switched to optional to ensure that the pam_unix module is reached in this stack. This appears to be required now to allow Active Directory users (LDAP+Kerberos) to be authorized to run X Windows.

0

The real issue was missing nscd.

Easily fixed by installing it

sudo apt install nscd

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.