<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
On 5/25/2010 5:16 PM, Andy Akins wrote:
<blockquote cite="mid:C821A86D.754B%25andy@egovtn.org" type="cite">
<title>Having trouble with LDAP Authentication...</title>
<font face="Calibri, Verdana, Helvetica, Arial"><span
style="font-size: 11pt;">I’ve google and searched, and have had very
little luck...<br>
<br>
I have:<br>
<br>
</span></font>
<ol>
<li><font face="Calibri, Verdana, Helvetica, Arial"><span
style="font-size: 11pt;">Installed all the packages.
</span></font></li>
<li><font face="Calibri, Verdana, Helvetica, Arial"><span
style="font-size: 11pt;">Configured and have running OpenLDAP.
</span></font></li>
<li><font face="Calibri, Verdana, Helvetica, Arial"><span
style="font-size: 11pt;">Migrated my passwd/shadow/group/hosts files
into the directory
</span></font></li>
<li><font face="Calibri, Verdana, Helvetica, Arial"><span
style="font-size: 11pt;">Tested the directory using ldapsearch
</span></font></li>
<li><font face="Calibri, Verdana, Helvetica, Arial"><span
style="font-size: 11pt;">Installed LAM (web interface to LDAP
authentication)
</span></font></li>
<li><font face="Calibri, Verdana, Helvetica, Arial"><span
style="font-size: 11pt;">Added a user using LAM.
</span></font></li>
<li><font face="Calibri, Verdana, Helvetica, Arial"><span
style="font-size: 11pt;">Confirmed user is in directory.
</span></font></li>
<li><font face="Calibri, Verdana, Helvetica, Arial"><span
style="font-size: 11pt;">Confirmed user is not in /etc/passwd
</span></font></li>
<li><font face="Calibri, Verdana, Helvetica, Arial"><span
style="font-size: 11pt;">Confirmed using “getent passwd | grep
username” that the user is listed.
</span></font></li>
<li><font face="Calibri, Verdana, Helvetica, Arial"><span
style="font-size: 11pt;">Confirmed using “getent passwd” shows two
records for each user <i>except</i> ldap-only users (one for
/etc/passwd, one for LDAP).<br>
</span></font></li>
</ol>
<font face="Calibri, Verdana, Helvetica, Arial"><span
style="font-size: 11pt;"><br>
However,<br>
<br>
“id username”<br>
<br>
Returns unknown user<br>
<br>
And trying to log in as username at either the terminal or ssh fails,
and upon examining the logs, the error message says unknown user.<br>
<br>
I configured /etc/pam.d/system-auth using authcongfig-tui, adding only
the pam_mkhomedir.so line (and I tried it without that line as well).<br>
<br>
Everything <i>seems</i> right – but its not working. Can anyone offer
any suggestions as to where I should be looking? If necessary, I’ll
post my /etc/openldap/slapd.conf, /etc/openldap/ldap.conf,
/etc/pam.d/system-auth, and /etc/nsswitch.conf files – I just didn’t
want to send them if not necessary.<br>
<br>
Any help or suggestions would be appreciated. Thanks!<br>
<br>
-- <br>
Andy Akins<br>
Director of Development<br>
<br>
NICUSA, Tennessee – A Partnership with Tennessee.gov<br>
Phone: (615) 313-0305<br>
Email: <a moz-do-not-send="true" href="andy@egovtn.org">andy@egovtn.org</a><br>
<br>
Visit <a class="moz-txt-link-abbreviated" href="http://www.tn.gov">www.tn.gov</a> - the official website of the State of Tennessee<br>
<br>
*****************************************************************<br>
CONFIDENTIALITY NOTICE:<br>
This email and any attachments are confidential. If you are not<br>
the intended recipient, you do not have permission to disclose,<br>
copy, distribute, or open any attachments. If you have received<br>
this email in error, please notify us immediately by returning<br>
it to the sender and deleting this copy from your system.<br>
Thank you. NIC, Inc., Tennessee<br>
*****************************************************************<br>
<br>
<br>
<br>
</span></font>
<pre wrap="">
<fieldset class="mimeAttachmentHeader"></fieldset>
_______________________________________________
CentOS mailing list
<a class="moz-txt-link-abbreviated" href="mailto:CentOS@centos.org">CentOS@centos.org</a>
<a class="moz-txt-link-freetext" href="http://lists.centos.org/mailman/listinfo/centos">http://lists.centos.org/mailman/listinfo/centos</a>
</pre>
</blockquote>
<br>
We'll assume you've properly configured your OpenLDAP server and can
query the directory and whatever user/group accounts you have created
are valid.<br>
<br>
Now, you make no statements regarding the system that you are
attempting to authenticate from. Run 'authconfig-tui' from the
console/terminal and ensure the ldap server is specified.<br>
<br>
See this page
(<a class="moz-txt-link-freetext" href="http://beginlinux.com/server_training/server-managment-topics/1316-set-up-ldap-client">http://beginlinux.com/server_training/server-managment-topics/1316-set-up-ldap-client</a>)
and concern yourself with the 2 screenshots for now. You can tweak the
manual settings to your hearts content but ONLY need to set the options
contained in the screenshots to at least get LDAP auth working.<br>
<br>
Make sure you leave an '*' next to 'Local authentication is sufficient'
as well so the system continues to auth local accounts. Placing a '*'
next to 'Cache Information' will enable nscd.<br>
<br>
<br>
<br>
Ryan Manikowski<br>
</body>
</html>