Problem is solved. From the version 2.4.23-15 is mandatory to use option tls_cacertfile in nslcd.conf file, in older versions worked only using tls_cacertdir.<div><br></div><div>Regards,</div><div>Esther<br><br><div class="gmail_quote">
2012/5/24 Esther Garcia <span dir="ltr">&lt;<a href="mailto:fulletverde@gmail.com" target="_blank">fulletverde@gmail.com</a>&gt;</span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi Rich,<div><br></div><div>Sorry I had a mistake in my ldapsearch. Ldapsearch is working but with it does not found users using &quot;id&quot; command:</div><div><br></div><div><div class="im"><div>[root@XX ~]# service nslcd restart</div>

<div>Stopping nslcd:                                            [  OK  ]</div><div>Starting nslcd:                                            [  OK  ]</div></div><div>[root@dc103 ~]# ldapsearch -x -D &#39;cn=authenticate, ou=System,dc=test, dc=es&#39; &#39;(objectclass=*)&#39; -W -ZZ</div>
<div class="im">
<div>Enter LDAP Password: </div><div># extended LDIF</div><div>#</div></div><div><div>[root@dc103 ~]# id esther</div><div class="im"><div>id: esther: No such user</div></div></div><div><br></div><div>And I have these entries in nsswitch:</div>
<div><br>
</div><div><div>[root@XX ~]# grep ldap /etc/nsswitch.conf</div><div>passwd:     files ldap</div><div>shadow:     files ldap</div><div>group:      files ldap</div></div><div><br></div><div>Errors in messages log when I try this &quot;id&quot; search:</div>

<div><br></div><div><div>May 24 10:50:09 XX nslcd[4612]: [8e1f29] no available LDAP server found</div><div>May 24 10:50:09 XX nslcd[4612]: [8e1f29] no available LDAP server found</div><div>May 24 10:50:09 XX nslcd[4612]: [e87ccd] no available LDAP server found</div>

<div>May 24 10:50:09 XX nslcd[4612]: [e87ccd] no available LDAP server found</div><div>May 24 10:50:11 XX nslcd[4612]: [1b58ba] ldap_start_tls_s() failed: Connect error (uri=&quot;ldap://ldap1-test&quot;)</div><div>May 24 10:50:11 XX nslcd[4612]: [1b58ba] failed to bind to LDAP server ldap://ldap1-test: Connect error</div>

<div>May 24 10:50:11 XX nslcd[4612]: [1b58ba] ldap_start_tls_s() failed: Connect error (uri=&quot;ldap://ldap2-test&quot;)</div><div>May 24 10:50:11 XX nslcd[4612]: [1b58ba] failed to bind to LDAP server ldap://ldap2-test: Connect error</div>

<div>May 24 10:50:11 XX nslcd[4612]: [1b58ba] no available LDAP server found</div></div><div><br></div><div>In version 2.4.19-15 I don&#39;t see this issue.</div><div><br></div><div>TIA,</div><div>Esther</div><div><div class="h5">
<br><div class="gmail_quote">
2012/5/23 Rich Megginson <span dir="ltr">&lt;<a href="mailto:rich.megginson@gmail.com" target="_blank">rich.megginson@gmail.com</a>&gt;</span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">


  
    
  
  <div bgcolor="#FFFFFF" text="#000000"><div><div>
    On 05/23/2012 10:37 AM, Esther Garcia wrote:
    <blockquote type="cite">Hi all,
      <div><br>
      </div>
      <div>We have an OpenLDAP server (RHEL6) running version 2.4.23-15,
        and we have clients in RHEL5 and RHEL6.</div>
      <div>With clients in RHEL5 works properly but I found some
        problems with RHEL6 clients in versions newer than 2.4.19-15.</div>
      <div><br>
      </div>
      <div>In the clients, if I try to upgrade to new versions than
        2.4.19-15 then the client stops working:</div>
      <div><br>
      </div>
      <blockquote style="margin:0pt 0pt 0pt 40px;border:medium none;padding:0px">
        <div>
          <div>[root@XX ~]# rpm -qa | grep openldap</div>
        </div>
        <div>
          <div>openldap-2.4.19-15.el6.x86_64</div>
        </div>
        <div>
          <div>openldap-clients-2.4.19-15.el6.x86_64</div>
        </div>
        <div>
          <div>[root@XX ~]# ldapsearch -x -D &#39;cn=authenticate,
            ou=System,dc=test, dc=es&#39; &#39;(objectclass=*)&#39; -W -ZZ</div>
        </div>
        <div>
          <div>Enter LDAP Password: </div>
        </div>
        <div>
          <div># extended LDIF</div>
        </div>
        <div>
          <div>#</div>
        </div>
        <div>
          <div># LDAPv3</div>
        </div>
        <div>
          <div>......</div>
        </div>
        <div>
          <div>[root@XX ~]# id esther</div>
        </div>
        <div>
          <div>
            uid=63004(esther) gid=50041(test) groups=50041(test)</div>
        </div>
        <div><br>
        </div>
        <div>
          <div>[root@XX ~]# yum upgrade openldap*</div>
        </div>
        <div>
          <div>.....</div>
        </div>
        <div>
          <div>  Updating   : openldap-2.4.23-20.el6.x86_64            
                                                                       
                                                                       
                            1/4 </div>
        </div>
        <div>
          <div>warning: /etc/openldap/ldap.conf created as
            /etc/openldap/ldap.conf.rpmnew</div>
        </div>
        <div>
          <div>  Updating   : openldap-clients-2.4.23-20.el6.x86_64    
                                                                       
                                                                       
                            2/4 </div>
        </div>
        <div>
          <div>  Cleanup    : openldap-clients-2.4.19-15.el6.x86_64    
                                                                       
                                                                       
                            3/4 </div>
        </div>
        <div>
          <div>  Cleanup    : openldap-2.4.19-15.el6.x86_64            
                                                                       
                                                                       
                            4/4 </div>
        </div>
        <div>
          <div><br>
          </div>
        </div>
        <div>
          <div>Updated:</div>
        </div>
        <div>
          <div>  openldap.x86_64 0:2.4.23-20.el6                        
                                                 
            openldap-clients.x86_64 0:2.4.23-20.el6                    
                                                     </div>
        </div>
        <div>
          <div><br>
          </div>
        </div>
        <div>
          <div>Complete!</div>
        </div>
        <div>
          <div><br>
          </div>
        </div>
        <div>
          <div>[root@XX ~]# service nslcd restart</div>
        </div>
        <div>
          <div>Stopping nslcd:                                          
             [  OK  ]</div>
        </div>
        <div>
          <div>Starting nslcd:                                          
             [  OK  ]</div>
        </div>
        <div>
          <div>[root@XX ~]# id esther</div>
        </div>
        <div>
          <div>id: esther: No such user</div>
        </div>
        <div>
          <div>[root@XX ~]# ldapsearch -x -D &#39;cn=authenticate,
            ou=System,dc=test, dc=es&#39; &#39;(objectclass=*)&#39; -W -ZZ</div>
        </div>
        <div>
          <div>ldap_start_tls: Connect error (-11)</div>
        </div>
      </blockquote>
    </blockquote>
    <br></div></div>
    try adding -d 1 - ldapsearch -d 1 -x ....<div><div><br>
    <blockquote type="cite">
      <blockquote style="margin:0 0 0 40px;border:none;padding:0px">
        <div><br>
        </div>
      </blockquote>
      I have the same configuration files that used with the older
      version. I use these configuration files:
      <div><br>
      </div>
      <blockquote style="margin:0 0 0 40px;border:none;padding:0px">
        <div><b>/etc/pam_ldap.conf:</b></div>
        <div>
          <div>base dc=test,dc=es</div>
        </div>
        <div>
          <div>binddn cn=authenticate,ou=System,dc=test,dc=es</div>
        </div>
        <div>
          <div>bindpw XXXX</div>
        </div>
        <div>
          <div>timelimit 120</div>
        </div>
        <div>
          <div>
            bind_timelimit 120</div>
        </div>
        <div>
          <div>idle_timelimit 3600</div>
        </div>
        <div>
          <div>pam_lookup_policy yes</div>
        </div>
        <div>
          <div>pam_password exop</div>
        </div>
        <div>
          <div>nss_initgroups_ignoreusers
root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd,gdm</div>
        </div>
        <div>
          <div>ssl start_tls</div>
        </div>
        <div>
          <div>uri <a>ldap://ldap1-test</a> <a>ldap://ldap2-test</a></div>
        </div>
        <div>
          <div>tls_cacertdir /etc/openldap/cacerts</div>
        </div>
        <div>
          <div>pam_password md5</div>
        </div>
        <div><br>
        </div>
        <div><b>/etc/nslcd.conf</b></div>
        <div>
          <div>uid nslcd</div>
        </div>
        <div>
          <div>gid ldap</div>
        </div>
        <div>
          <div>uri <a>ldap://ldap1-test</a> <a>ldap://ldap2-test</a></div>
        </div>
        <div>
          <div>base dc=test,dc=es</div>
        </div>
        <div>
          <div>binddn cn=authenticate,ou=System,dc=test,dc=es</div>
        </div>
        <div>
          <div>bindpw XXXX</div>
        </div>
        <div>
          <div>ssl start_tls</div>
        </div>
        <div>
          <div>tls_cacertdir /etc/openldap/cacerts</div>
        </div>
        <div>
          <div>timelimit 120</div>
        </div>
        <div>
          <div>bind_timelimit 120</div>
        </div>
        <div>
          <div>idle_timelimit 3600</div>
        </div>
        <div><br>
        </div>
        <div><b>/etc/openldap/ldap.conf:</b></div>
        <div>
          <div>URI <a>ldap://ldap1-test/</a> <a>ldap://ldap2-test/</a></div>
        </div>
        <div>
          <div>BASE dc=test,dc=es</div>
        </div>
        <div>
          <div>TLS_CACERT /etc/openldap/cacerts/catest.crt</div>
        </div>
        <div>
          <div><br>
          </div>
        </div>
        <div>
          <div><b>CAcert file:</b></div>
        </div>
        <div>
          <div><br>
          </div>
        </div>
        <div>
          <div>
            <div>[root@XX ~]# ls -l /etc/openldap/cacerts/catest.crt</div>
          </div>
        </div>
        <div>
          <div>
            <div>-rw-r--r--. 1 root root 1655 May 23 15:23
              /etc/openldap/cacerts/catest.crt</div>
          </div>
        </div>
        <div><br>
        </div>
      </blockquote>
      Any idea on what the issue is? Am I missing anything?<br>
      <blockquote style="margin:0 0 0 40px;border:none;padding:0px">
        <div><br>
        </div>
      </blockquote>
      Thanks in advance,
      <div>Esther<br>
        <div>
          <div><br>
          </div>
          <div><br>
          </div>
          <div><br>
          </div>
        </div>
      </div>
    </blockquote>
    <br>
  </div></div></div>

</blockquote></div><br></div></div></div>
</blockquote></div><br></div>