Hi,
I was triaging this issue and I ran into another mysterious area, it doesn't look like the number (8) of principals/RDN is the problem and infact the length/size of the RDN's could be the issue. Please find the /etc/ldap.conf files attached renamed according to the AD/openldap server being configured.
a. In the ad_ldap_conf_size the number of characters is around 3137 for the nss_base_<map>. On line 122, if i just make the 80 as 8 in the end of the string, the command "getent passwd" is working and it lists all the users registered in the ldap.conf file but otherwise it doesn't show any user.
b. In the open_ldap_conf_size_issue the number of characters is around 3103 for the nss_base_<map>. In the end of the file if i just comment the last two lines, the "getent passwd" is working and it lists all the users registered in the ldap.conf file but otherwise it doesn't show any user.
from these findings this looks more like some buffer issue, can you please help me with the following. 1. Any particular method/file that I should be looking for to check this buffer size may be even in the nss_ldap library or so 2. If there is a buffer size issue of say around 3137 characters (bytes for that), what would be the best value to increase it.
appreciate any help
Thanks Ramakanth
On 30 March 2011 01:17, Srivatsav M srivatsav.mudumba@gmail.com wrote:
Please find below the answers to your questions:
server (Open LDAP, Active Directory).
Which one? Or both?
Our dev environment has openLDAP and AD servers and we have tested this issue against each of them individually and are able to reproduce it against both the types of LDAP servers
- Users shouldn't be "registered in the /etc/ldap.conf file".
Can you please help me understand why I shouldn't be using this in the
ldap.conf file?
- Please supply a full copy of your /etc/ldap.conf, or at least a
representative one, and provide the example output of 'getent passwd username' and 'groups
attached along with this mail
username' for the user who doesn't authenticate. You may also want to supply the relevant PAM configuration files.
$ getent passwd root <xxxxxxxxx> test_user:somepwd:1002:1002:Test User:/home/testuser:/bin/bash test_people1:*:10004:10004:Test People1:/home/test_people1:/bin/bash
All external users are not able to login after adding the 8th principal/RDN
/etc/pam.d/common-auth
auth required pam_env.so auth sufficient pam_ldap.so use_first_pass auth required pam_unix2.so
/etc/pam.d/common-account
account required pam_unix2.so account sufficient pam_localuser.so account required pam_ldap.so use_first_pass
/etc/pam.d/common-session
session required pam_limits.so session required pam_unix2.so session required pam_mkhomedir.so skel=/etc/skel/ session optional pam_ldap.so session optional pam_umask.so
Also, please provide details of your LDAP client (distribution release, what versions of nss_ldap and pam_ldap you are running).
openldap2-client-2.3.32-0.25 nss_ldap-259-4.3
- Do we know what the actual problem is? Do we know it would be solved by
nss-ldapd?
There might be a simple misunderstanding here, or a simple configuration problem, and switching software might not solve that.
Additionally, the distribution in question may have a different preferred LDAP client.
based on the above information, would it be possible for pointing any config. issues? , please do let me know if you need any further information.
thanks
Ramakanth
On 25 March 2011 20:23, Marco Pizzoli marco.pizzoli@gmail.com wrote:
Hi, I could be corrected if I'm wrong, but this problem is not related to OpenLDAP. It's a nss_ldap problem. nss_ldap is a client library that's used by linux vendors to achieves seamless integration of users against *a* LDAP server.
I had a similar problem with a complex configuration and bypassed (not solved) the problem by modifying my client configuration.
I reduced the number of ldap server configured to be accessed: from 4 to 3. I reduced the number of users defined in *nss_initgroups_ignoreusers*directive: i had about 40 listed in it...
Etc...
Make some tries and tell me if you can solve it.
Marco
On Thu, Mar 24, 2011 at 9:25 PM, Srivatsav M <srivatsav.mudumba@gmail.com
wrote:
Hi,
We are using OpenLDAP for authenticating users registered in a LDAP server (Open LDAP, Active Directory). After adding 8 principals (/etc/ldap.conf), none of the users registered in the /etc/ldap.conf file are able to login.
nss_base_passwd OU=engg,DC=mycompany,DC=region,DC=someplace,DC=myarea,DC=compname,DC=parentcompname nss_base_shadow OU=engg,DC=mycompany,DC=region,DC=someplace,DC=myarea,DC=compname,DC=parentcompname nss_base_group OU=engg,DC=mycompany,DC=region,DC=someplace,DC=myarea,DC=compname,DC=parentcompname
Can you please share the reason for this 7 limitation in the open ldap library. or how I can fix this issue. I am looking i for the header file in the source files whhich has this constant or limitation defined.
Tried googling, but it appears that no one has encountered this issue. Some customers are running into this issue and it has become a severity 1 issue to fix.
Thanks Ramakanth
-- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison
openldap-technical@openldap.org
-
Srivatsav M