Just tried switching from Linux Mint to Ubuntu 18.10 but encountered numerous problems with accounts. All the steps to recreate are below in details.
I would love to know how Ubuntu 18.10 differentiates the Locally created users compared to the ones on LDAP server and why so many features are broken for LDAP users.
- LDAP accounts cannot be logged in using the default gdm3 display manager. Upon setting up LDAP using method described below, you can login as the user in the terminal no problem, but you are unable to login via gdm3. If you try it instantly kicks you out back onto lock screen. Users created locally via the interface have no such problems. Switching to lightdm lets you login with LDAP account.
- Local admin accounts can use GUI admin elements, such as the unlock button in "Settings - Users", same unlock button in "Printers" and throughout the interface. On the other hand, LDAP account don't have the policy to use the GUI admin elements, even if added to sudoers via visudo and added to all relevant lines in /etc/groups. This probably has something to do with polkit but I don't know how to modify and fix the issue. I tried following these steps from 2012 but to no avail.
- LDAP accounts suffer from some broken features, for example: GUI buttons to restart/shut down don't work and there are no Sound devices recognised and restarting/installing pavucontrol does not help. It gives you a permissions error even if used with sudo (shouldn't be needed/used). Printers don't work by default either.
The way to reproduce:
Fresh clean install of Ubuntu 18.10
Set up LDAP by:
sudo apt-get install libnss-ldap libpam-ldap
Edit the /etc/nsswitch.conf file and add ldap to the passwd, group and shadow lines
Edit the /etc/pam.d/common-session file to add the following line
session required pam_mkhomedir.so skel=/etc/skel umask=0022
Open terminal and try to switch to different user (LDAP). It should work.
Using ubuntu interface, log out and try login with the same user (LDAP), it shouldn't work and should boot-loop.
Log back in using normal 'Local' admin account and switch to lightdm with:
sudo apt install lightdm
To be able to actually log-in with a LDAP username, create /etc/lightdm/lightdm.conf and add
[Seat:*] allow-guest=true greeter-show-manual-login=true
Restart the machine and log in using LDAP account.
See that the problems described above are present. Then try fixing them by adding the LDAP user to sudoer and relevant groups.