I am using LDAP+kerberos to authenticate against Active Directory on Windows 2003 R2. My krb5.conf and ldap.conf appear to be correct (according to pretty much every sample I found on
the 'net). I can login to
the host with both password and ssh keys. When I run getent passwd, all my ldap user accounts are listed with all
the important attributes. When I run getent group, all
the ldap groups and their gid's are listed, but no group members. If I run ldapsearch and filter on any group,
the members are all listed with
the "member" attribute. So
the data is there for
the taking, it's just not being parsed properly. It would appear that I simply am using an incorrect mapping in ldap.conf, but I can't see it. I've tried several variations and all give
the same result.
Here is my current ldap.conf:
host <ad-host1-ip> <ad-host2-ip>
base dc=my,dc=full,dc=dn
uri ldap://<ad-host1> ldap://<ad-host2>
ldap_version 3
binddn <mybinddn>
bindpw <mybindpw>
scope sub
bind_policy hard
nss_reconnect_tries 3
nss_reconnect_sleeptime 1
nss_reconnect_maxsleeptime 8
nss_reconnect_maxconntries 3
nss_map_objectclass posixAccount User
nss_map_objectclass posixGroup Group
nss_map_attribute uid sAMAccountName
nss_map_attribute gidNumber msSFU30GidNumber
nss_map_attribute uidNumber msSFU30UidNumber
nss_map_attribute cn cn
nss_map_attribute gecos displayName
nss_map_attribute homeDirectory msSFU30HomeDirectory
nss_map_attribute loginShell msSFU30LoginShell
nss_map_attribute uniqueMember member
pam_filter objectcategory=User
pam_login_attribute sAMAccountName
pam_member_attribute member
pam_password ad
Here's
the kicker: this config works 100% fine on a different linux box with a different distro. It does not work on
the distro I am planning on switching to. I have installed from source
the versions of pam_ldap and nss_ldap on
the new box to match
the old box, which fixed another problem I was having with this setup.
Other relevant info is
the original AD box was Windows 2003. It's mirror died a horrible hardware death so I'm trying to add two more 2003-R2 servers to
the mirror tree and ultimately drop
the old 2003 box.
The new R2 boxes appear to have joined
the DC forest properly.
What do I need to do to get groups working? I've exhausted all
the resources I could find and need a different angle. Any input is appreciated.
Status update, 7/31/09
I have managed to tweak my config file to get full info from
the AD and performance is nice and snappy. I replaced
the back-rev'd copies of pam_ldap and nss_ldap with
the current ones for
the distro I'm using, so it's back to a standard out-of-the-box install. Here's my current config:
host <ad-host1-ip> <ad-host2-ip>
base dc=my,dc=full,dc=dn
uri ldap://<ad-host1> ldap://<ad-host2>
ldap_version 3
binddn <mybinddn>
bindpw <mybindpw>
scope sub
bind_policy soft
nss_reconnect_tries 3
nss_reconnect_sleeptime 1
nss_reconnect_maxsleeptime 8
nss_reconnect_maxconntries 3
nss_connect_policy oneshot
referrals no
nss_map_objectclass posixAccount User
nss_map_objectclass posixGroup Group
nss_map_attribute uid sAMAccountName
nss_map_attribute gidNumber msSFU30GidNumber
nss_map_attribute uidNumber msSFU30UidNumber
nss_map_attribute cn cn
nss_map_attribute gecos displayName
nss_map_attribute homeDirectory msSFU30HomeDirectory
nss_map_attribute loginShell msSFU30LoginShell
nss_map_attribute uniqueMember member
pam_filter objectcategory=CN=Person,CN=Schema,CN=Configuration,DC=w2k,DC=cis,DC=ksu,DC=edu
pam_login_attribute sAMAccountName
pam_member_attribute member
pam_password ad
ssl off
tls_checkpeer no
sasl_secprops maxssf=0
The remaining problem now is when you run
the groups command, not all subscribed groups are listed. Some are (one or two), but not all. Group memberships are still honored, such as file and printer access. getent group foo still shows that
the user is a member of group foo. So it appears to be a presentation
bug, and does not interfere with normal operation.
It also appears that some (I have not determined exactly how many) group searches do not resolve correctly, even though
the group is listed. eg, when you run "getent group bar", nothing is returned, but if you run "getent group|grep bar" or "getent group|grep <bar_gid>" you can see that it indeed listed and your group name and gid are correct.
This still seems like an LDAP search or mapping error, but I can't figure out what it is. I'm a heckuva lot closer than earlier in
the week, but I'd really like to get this last detail ironed out.
