1

I am trying to enable LDAP authentication on my ubuntu client. So far I tried the following instructions: https://www.tecmint.com/configure-ldap-client-to-connect-external-authentication/

https://www.howtoforge.com/linux_ldap_authentication

https://wiki.archlinux.org/index.php/LDAP_authentication#Client_Setup

https://computingforgeeks.com/how-to-configure-ubuntu-18-04-ubuntu-16-04-lts-as-ldap-client/

and since it did not work I came across some solutions like changing libnss-ldap to libnss-ldapd according to 16.04 server: enabling LDAP authentication causes systemd-logind to fail

and at some point I started to mix up all these solutions together and so on but so far no luck. I can run ldapsearch on the client machine and get all the information of a user in my ldap server but I can not see any of the ldap users inside passwd file when running getent passwd and hence I can't login with any of my ldap users to the client machine either. The only new user added in my passwd file is nslcd with the description of "name service LDAP connection daemon". So I will really appreciate if someone could help me with this problem.

I should let you know that my openldap runs on a different machine inside a docker container. So far I managed to successfully connect it so keycloak, bookstack and lime survey. So it actually have been in use for quite some time now.

Thank you very much in advance

1
1

Are you experiencing any particular error when you run the getent passwd command or try to login with an ldap user login? At this point with all of the edits that you have made to your configurarion, if you have followed each of those tutorials, you might be better off starting over again with setting up the client-side configuration fresh. I did notice that one of the tutorials that you listed has the ldapi uri format as ldapi:///domain when it most likely should be more like ldapi://domain:389/ In my case I have had success using ldap://domainOrIP:389/ as the format for the URI. Also the default client-side configuration will point to cn=manager dn=example dn=net. It may be easy to overlook an inconsistency such as if your domain for your openldap server is dn=com or cn=admin. To start over fresh with your client configuration you could run something like sudo apt -y remove --purge libnss-ldap libpam-ldap ldap-utils Then reinstall and begin with a fresh configuration by running sudo apt -y install libnss-ldap libpam-ldap ldap-utils in the terminal. The computing for geeks instructions seemed similar to my process for setting up the client-side configuration, but you are welcome to try out my instructions.

https://tux-techie.com/2020/10/13/configuring-ubuntu-linux-to-authenticate-to-an-ldap-server/

I hope something there is helpful. Keep us posted on your progress.

5
  • Hey Ernie, thank you so much for your answer. I think I know what causes the issue but do not know how to solve it. All my LDAP users are in "organizationalPerson" object class but for authentication to work they should be in "posixAccount" (if I undrestood it right). Is there a way that I can change this in the configuration? Oct 19 '20 at 8:11
  • Yes I created a test user and it worked. I also add posixAccount as an objectclass for my own user in our ldap and it worked. I was just wondering is there a way to add this to all other users without having to do it one by one? Oct 19 '20 at 12:30
  • That is correct. They need to be in a posix account group. I dont know of a way to do that by command-line. Do you have phpldapadmin setup for your open ldap server? If you make any changes it may be a good idea to setup a test account to make sure the setup works. Here is how my users are setup. tux-techie.com/2020/10/12/… On the same screen where you create child entries in phplapadmin there is an option to copy or move entry. Need unique attribution requirement disabled. phpldapadmin-users.narkive.com/zAdgJ5ZL/can-t-copy-entries Oct 19 '20 at 12:32
  • I am glad you got a test account working. www.digitalocean.com/community/tutorials/how-to-use-ldif-files-to-make-changes-to-an-openldap-system.amp Discusses the changetype: modrdn operation for renaming or moving entries. But it appears to require that you edit the ldif files individually. But perhaps that will at least point you in the right direction if there is a way to specify multiple users and make the edit once. In the end you may save time just making the changes in phpldapadmin. Oct 19 '20 at 13:05
  • I also think it would be easy to do that for the current users. The point here is that the user registration in my server happens through a keycloak instant. So I think I should try to add posixAccount into the object class in user federation there for future. Thank you very much. Oct 19 '20 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.