I have problem to use my openldap 2.4 server for authentication on a fedora 14 : it sounds that the problem is on the on the client side configuration.

Here are some logs : your help to diag would be appreciated.

-> I have an ldap server that that stores posixAccount and respond to ldap queries. -> I have configure a client machine to use this ldap server for authentication when login :

***** LOGS ***

**** CLIENT side ****

login: olivier passe :

Login incorrect

**** SERVER when login on the client ***

Here is what I see on the server side (IP=10.1.92.24) when I try to log in as "olivier" on the client (10.1.86.93) using /bin/login (debug level 256) :

conn=1220 fd=13 ACCEPT from IP=10.1.86.93:54458 (IP=10.1.92.24:389) conn=1220 op=0 BIND dn="" method=128 conn=1220 op=0 RESULT tag=97 err=0 text= conn=1220 op=1 SRCH base="ou=People,ou=staff,dc=mydomain,dc=fr" scope=2 deref=0 filter="(uid=olivier)" conn=1220 op=1 SRCH attr=host authorizedService shadowExpire shadowFlag shadowInactive shadowLastChange shadowMax shadowMin shadowWarning uidNumber conn=1220 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text=

*** CLIENT When using ldappasswd *****

I manage to change the "userPassword" attributes using ldappasswd command, here are the logs on the client and server side :

Client side :

$ ldapsearch -h ldap-master1.mydomain.fr -D "cn=Manager,dc=mydomain,dc=fr" -w secret "uid=olivier"

dn: uid=olivier,ou=Staff,ou=People,dc=mydomain,dc=fr uid: olivier ... objectClass: account objectClass: posixAccount objectClass: top userPassword:: e1NTSEF9UmlYdnk4MWtaZ0NMS2hyZnBvd2hlaezrbTd7aR5LU0s=

$ ldappasswd -h -h ldap-master1.mydomain.fr -D "cn=Manager,dc=mydomain,dc=fr" -w secret "uid=olivier,ou=Staff,ou=People,dc=mydomain,dc=fr" -s newpass

$ ldapsearch -h ldap-master1.mydomain.fr -D "cn=Manager,dc=mydomain,dc=fr" -w secret "uid=olivier"

dn: uid=olivier,ou=Staff,ou=People,dc=mydomain,dc=fr uid: olivier ... objectClass: account objectClass: posixAccount objectClass: top userPassword:: e1NTSEF9UmlYdnk4MWtaZ0NMS2hyZnBvd2hlaezrbTd7aR5LU0s=

*** SERVER side When using ldappasswd *****

Server side, here are the logs related to ldapppasswd :

conn=1000 fd=11 ACCEPT from IP=10.1.86.93:52074 (IP=10.1.92.24:389) conn=1000 op=0 BIND dn="cn=Manager,dc=mydomain,dc=fr" method=128 conn=1000 op=0 BIND dn="cn=Manager,dc=mydomain,dc=fr" mech=SIMPLE ssf=0 conn=1000 op=0 RESULT tag=97 err=0 text= conn=1000 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.1 conn=1000 op=1 PASSMOD id="uid=olivier,ou=Staff,ou=People,dc=mydomain,dc=fr" new conn=1000 op=1 RESULT oid= err=0 text= conn=1000 op=2 UNBIND conn=1000 fd=11 closed

Thanks for your help,

---- Olivier

On Tue, Jul 12, 2011 at 7:59 PM, Olivier Guillard olivier@guillard.nom.fr wrote:

Hello

Here is the result of an ldapsearch on a client host :

$ ldapsearch -h ldap-master1.mydomain.fr -D "cn=Manager,dc=mydomain,dc=fr" -w secret "uid=olivier"

dn: uid=olivier,ou=Staff,ou=People,dc=mydomain,dc=fr uid: olivier loginShell: /bin/tcsh cn: Olivier uidNumber: 1130 gidNumber: 18104 homeDirectory: /home/olivier objectClass: account objectClass: posixAccount objectClass: top userPassword:: e1NTSEF9UmlYdnk4MWtaZ0NMS2hyZnBvd2hlaezrbTd7aR5LU0s=

I have the same output with this :

$ ldapsearch -h ldap-master1.mydomain.fr -D "uid=olivier,ou=Staff,ou=People,dc=mydomain,dc=fr" -w pass-olivier "uid=olivier"

Although if I omit the -w I get this :

ldap_bind: Server is unwilling to perform (53)       additional info: unauthenticated bind (DN with no password) disallowed

--->> the openldap server respond.

================

On the client side (fedora 14), I have followed the documentation to set up for ldap authentication when login :

/etc/nsswitch.conf  /etc/ldap.conf /etc/nss_ldap.conf /etc/pam_ldap.conf /etc/openldap/ldap.conf and /etc/pam.d/

are configured for the system to query the ldap-master.mydomain.fr server for authentication :

in ldap.conf files I have :

uri ldap://ldap-master1.mydomain.fr and "rootbinddn cn=Manager,dc=mydomain,dc=fr"

in nsswitch.conf : passwd: ldap shadow:  ldap

and in pam.d/password-auth and pam.d/system-auth and pam.d/system-auth-ac I have the lines :

auth        sufficient    pam_ldap.so use_first_pass account     [default=bad success=ok user_unknown=ignore] pam_ldap.so password    sufficient    pam_ldap.so use_authtok session     optional      pam_ldap.so

I use no particular security mechanism at this stage at this stage (no TLS, simple auth, etc.).

====

WITH ALL THIS, here is what I get in the logs when I try to login as "olivier" on the client machine:

Jul 12 19:32:20 fouine login: nss_ldap: failed to bind to LDAP server ldap://ldap-master1.mydomain.fr: Can't contact LDAP server Jul 12 19:32:20 fouine login: nss_ldap: could not search LDAP server - Server is unavailable

Of course, i can't log in.

Any help ??? I'm getting mad...

( may be could you suggest which debug level I should use on the server to try to track what's going on).

Thanks,

---

Olivier