Differences

This shows you the differences between two versions of the page.

--- ldap_authentication [2007/07/10 18:21] – New page: == Getting user information from [[LDAP]] == The <code>libnss-ldap</code> package handles fetching account information from LDAP. Also make sure that <code>nscd</code> is installed, other... mediawiki_default
+++ ldap_authentication [2026/09/26 21:49] (current) – removed - external edit (Unknown date) 127.0.0.1
@@ Line 1: / Line 1: @@
-====== Getting user information from [[ldap]] ======
-The <code>libnss-ldap</code> package handles fetching account information from LDAP.
-Also make sure that <code>nscd</code> is installed, otherwise [[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=190072|bad things]] may happen.
-To tell <code>libnss-ldap</code> where to look, you need to edit
-the <code>/etc/libnss-ldap.conf</code>.  At the very least, you'll need to
-give the host and base (<code>dc=tardis,dc=ed,dc=ac,dc=uk</code>).
-To tell libc to use <code>libnss-ldap</code>, you need to amend the appropriate lines in <code>/etc/nsswitch.conf</code>:
-  passwd:         files ldap
-  group:          files ldap
-  shadow:         files ldap
-The other databases are best left alone; we don't bother putting host
-information or such like in LDAP because we don't see much benefit.
-The <code>getent</code> program is useful for testing.
-====== Authenticating with [[ldap]] ======
-The <code>libpam-ldap</code> package is used for authentication against LDAP.  You need to configure <code>/etc/pam_ldap.conf</code> along the same lines as <code>/etc/libnss_ldap.conf</code>.  A typical example is:
-  host piper
-  base dc=tardis,dc=ed,dc=ac,dc=uk
-  rootbinddn cn=admin,dc=tardis,dc=ed,dc=ac,dc=uk
-  ldap_version 3
-  # NSS lookups need to be restricted to the appropriate parts of the tree.
-  # If other lookups are added to /etc/nsswitch.conf, they need to be put
-  # here too.
-  nss_base_passwd ou=People,dc=tardis,dc=ed,dc=ac,dc=uk
-  nss_base_group   ou=Group,dc=tardis,dc=ed,dc=ac,dc=uk
-  nss_base_shadow ou=People,dc=tardis,dc=ed,dc=ac,dc=uk
-  # Use funky generic LDAP password changing.
-  pam_password exop
-PAM needs to be told to use <code>libpam-ldap</code>, as well as the normal authentication for <code>root</code>.  Canonical <code>/etc/pam.d/common-auth</code>:
-  # ** Use trick from /usr/share/doc/libpam-ldap/README.Debian
-  #
-  auth    [success=1 default=ignore]      pam_unix.so nullok_secure
-  auth    required                        pam_ldap.so use_first_pass
-  auth    required                        pam_permit.so
-Note the <code>use_first_pass</code> option.  Without it logins will ask for a password for pam_unix, then one for pam_ldap, and so on, causing every other attempt to enter your password to fail even when you get it right.  You need to set up <code>/etc/pam.d/common-account</code> in the same way.