CentOS5 Desktops authenticating to 389 Directory Server

[Clint Dilks]

Hi Everyone.

I am doing some LDAP testing.  I have setup a 389 Directory Server on
CentOS 5 and using the default schema I have populated it with a couple
of users. I then did the configuration on the  client that I thought was
needed to make it authenticate.

To test this I expected to be able to use id <uidNumber> of a user I had
defined.
But I get id: 1001: No such user id: 5001: No such user

I then thought perhaps it was an LDAP permissions problem so I tried
binding to the LDAP server using a user I know has full rights using
these entries in /etc/openldap/ldap.conf  there was no change.

BINDDN cn=admin,dc=scms,dc=waikato,dc=ac,dc=nz
BINDPW LDAPt3st

I can query these users from a desktop that I want to use the LDAP
server as an authentication source.

Using

* ldapsearch -x -H ldap://distilled.scms.waikato.ac.nz -b
dc=scms,dc=waikato,dc=ac,dc=nz uid=LDilks*
# extended LDIF
#
# LDAPv3
# base <dc=scms,dc=waikato,dc=ac,dc=nz> with scope subtree
# filter: uid=LDilks
# requesting: ALL
#

# LDilks, People, scms.waikato.ac.nz
dn: uid=LDilks,ou=People, dc=scms, dc=waikato, dc=ac, dc=nz
givenName: LDAP-Clint
sn: Dilks
telephoneNumber: 4546
loginShell: /bin/bash
gidNumber: 1001
uidNumber: 1001
mail: clintd(a)scms.waikato.ac.nz
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetorgperson
objectClass: posixAccount
uid: LDilks
gecos: A Test LDAP account
cn: LDAP-Clint Dilks
homeDirectory: /home/LDAP-clint

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

*[root@distilled2 ~]# ldapsearch -x -H
ldap://distilled.scms.waikato.ac.nz -b dc=scms,dc=waikato,dc=ac,dc=nz
uid=BBuilder*
# extended LDIF
#
# LDAPv3
# base <dc=scms,dc=waikato,dc=ac,dc=nz> with scope subtree
# filter: uid=BBuilder
# requesting: ALL
#

# BBuilder, scms.waikato.ac.nz
dn: uid=BBuilder,dc=scms, dc=waikato, dc=ac, dc=nz
givenName: Bob
sn: Builder
loginShell: /bin/bash
uidNumber: 5001
gidNumber: 5001
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetorgperson
objectClass: posixAccount
uid: BBuilder
gecos: Got to love Cartoons
cn: Bob Builder
homeDirectory: /home/bob

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

The three files config files I am aware of are

cat /etc/openldap/ldap.conf
#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

#BASE   dc=example, dc=com
#URI    ldap://ldap.example.com ldap://ldap-master.example.com:666

#SIZELIMIT      12
#TIMELIMIT      15
#DEREF          never
URI ldap://distilled.scms.waikato.ac.nz
BASE dc=scms.dc=waikato,dc=ac,dc=nz
#BINDDN cn=admin,dc=scms,dc=waikato,dc=ac,dc=nz
#BINDPW LDAPt3st
TLS_CACERTDIR /etc/openldap/cacerts

cat /etc/nsswitch.conf | grep -v '^#' | grep -v '^$'
passwd:     files ldap
shadow:     files ldap
group:      files ldap
hosts:      files dns
bootparams: nisplus [NOTFOUND=return] files
ethers:     files
netmasks:   files
networks:   files
protocols:  files
rpc:        files
services:   files
netgroup:   files ldap
publickey:  nisplus
automount:  files ldap
aliases:    files nisplus

cat /etc/pam.d/system-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_ldap.so use_first_pass
auth        required      pam_deny.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass
use_authtok
password    sufficient    pam_ldap.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in
crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_ldap.so

Can anyone give me any pointers as to where I am going wrong ??  And can
anyone confirm or deny that by default I should be able to bind
anonymously and get the required authentication information ?

Thank you for any help you can offer.

[John A. Sullivan III]

On Fri, 2009-05-22 at 12:00 +1200, Clint Dilks wrote:
>  Hi Everyone.
>  
>  I am doing some LDAP testing.  I have setup a 389 Directory Server on
>  CentOS 5 and using the default schema I have populated it with a couple
>  of users. I then did the configuration on the  client that I thought was
>  needed to make it authenticate.
>  
>  To test this I expected to be able to use id <uidNumber> of a user I had
>  defined.
>  But I get id: 1001: No such user id: 5001: No such user
>  
>  I then thought perhaps it was an LDAP permissions problem so I tried
>  binding to the LDAP server using a user I know has full rights using
>  these entries in /etc/openldap/ldap.conf  there was no change.
>  
>  BINDDN cn=admin,dc=scms,dc=waikato,dc=ac,dc=nz
>  BINDPW LDAPt3st
>  
>  I can query these users from a desktop that I want to use the LDAP
>  server as an authentication source.
>  
>  Using
>  
>  * ldapsearch -x -H ldap://distilled.scms.waikato.ac.nz -b
>  dc=scms,dc=waikato,dc=ac,dc=nz uid=LDilks*
>  # extended LDIF
>  #
>  # LDAPv3
>  # base <dc=scms,dc=waikato,dc=ac,dc=nz> with scope subtree
>  # filter: uid=LDilks
>  # requesting: ALL
>  #
>  
>  # LDilks, People, scms.waikato.ac.nz
>  dn: uid=LDilks,ou=People, dc=scms, dc=waikato, dc=ac, dc=nz
>  givenName: LDAP-Clint
>  sn: Dilks
>  telephoneNumber: 4546
>  loginShell: /bin/bash
>  gidNumber: 1001
>  uidNumber: 1001
>  mail: clintd(a)scms.waikato.ac.nz
>  objectClass: top
>  objectClass: person
>  objectClass: organizationalPerson
>  objectClass: inetorgperson
>  objectClass: posixAccount
>  uid: LDilks
>  gecos: A Test LDAP account
>  cn: LDAP-Clint Dilks
>  homeDirectory: /home/LDAP-clint
>  
>  # search result
>  search: 2
>  result: 0 Success
>  
>  # numResponses: 2
>  # numEntries: 1
>  
>  *[root@distilled2 ~]# ldapsearch -x -H
>  ldap://distilled.scms.waikato.ac.nz -b dc=scms,dc=waikato,dc=ac,dc=nz
>  uid=BBuilder*
>  # extended LDIF
>  #
>  # LDAPv3
>  # base <dc=scms,dc=waikato,dc=ac,dc=nz> with scope subtree
>  # filter: uid=BBuilder
>  # requesting: ALL
>  #
>  
>  # BBuilder, scms.waikato.ac.nz
>  dn: uid=BBuilder,dc=scms, dc=waikato, dc=ac, dc=nz
>  givenName: Bob
>  sn: Builder
>  loginShell: /bin/bash
>  uidNumber: 5001
>  gidNumber: 5001
>  objectClass: top
>  objectClass: person
>  objectClass: organizationalPerson
>  objectClass: inetorgperson
>  objectClass: posixAccount
>  uid: BBuilder
>  gecos: Got to love Cartoons
>  cn: Bob Builder
>  homeDirectory: /home/bob
>  
>  # search result
>  search: 2
>  result: 0 Success
>  
>  # numResponses: 2
>  # numEntries: 1
>  
>  The three files config files I am aware of are
>  
>  cat /etc/openldap/ldap.conf
>  #
>  # LDAP Defaults
>  #
>  
>  # See ldap.conf(5) for details
>  # This file should be world readable but not world writable.
>  
>  #BASE   dc=example, dc=com
>  #URI    ldap://ldap.example.com ldap://ldap-master.example.com:666
>  
>  #SIZELIMIT      12
>  #TIMELIMIT      15
>  #DEREF          never
>  URI ldap://distilled.scms.waikato.ac.nz
>  BASE dc=scms.dc=waikato,dc=ac,dc=nz
>  #BINDDN cn=admin,dc=scms,dc=waikato,dc=ac,dc=nz
>  #BINDPW LDAPt3st
>  TLS_CACERTDIR /etc/openldap/cacerts
>  
>  cat /etc/nsswitch.conf | grep -v '^#' | grep -v '^$'
>  passwd:     files ldap
>  shadow:     files ldap
>  group:      files ldap
>  hosts:      files dns
>  bootparams: nisplus [NOTFOUND=return] files
>  ethers:     files
>  netmasks:   files
>  networks:   files
>  protocols:  files
>  rpc:        files
>  services:   files
>  netgroup:   files ldap
>  publickey:  nisplus
>  automount:  files ldap
>  aliases:    files nisplus
>  
>  cat /etc/pam.d/system-auth
>  #%PAM-1.0
>  # This file is auto-generated.
>  # User changes will be destroyed the next time authconfig is run.
>  auth        required      pam_env.so
>  auth        sufficient    pam_unix.so nullok try_first_pass
>  auth        requisite     pam_succeed_if.so uid >= 500 quiet
>  auth        sufficient    pam_ldap.so use_first_pass
>  auth        required      pam_deny.so
>  
>  account     required      pam_unix.so broken_shadow
>  account     sufficient    pam_succeed_if.so uid < 500 quiet
>  account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
>  account     required      pam_permit.so
>  
>  password    requisite     pam_cracklib.so try_first_pass retry=3
>  password    sufficient    pam_unix.so md5 shadow nullok try_first_pass
>  use_authtok
>  password    sufficient    pam_ldap.so use_authtok
>  password    required      pam_deny.so
>  
>  session     optional      pam_keyinit.so revoke
>  session     required      pam_limits.so
>  session     [success=1 default=ignore] pam_succeed_if.so service in
>  crond quiet use_uid
>  session     required      pam_unix.so
>  session     optional      pam_ldap.so
>  
>  Can anyone give me any pointers as to where I am going wrong ??  And can
>  anyone confirm or deny that by default I should be able to bind
>  anonymously and get the required authentication information ?
>  
>  Thank you for any help you can offer. 
<snip>
Interesting! I know my setup is working yet, if I do id <uidnumber>, it
comes back with no such user.  If I do id <uid>, it returns the
appropriate information from LDAP.  I have not taken the time to figure
out why there is a difference.  What happens if you do id <uid>? - John
-- 
John A. Sullivan III
Open Source Development Corporation
[phone]
jsullivan(a)opensourcedevel.com

http://www.spiritualoutreach.com
Making Christianity intelligible to secular society

[Clint Dilks]

<snip>
>  Interesting! I know my setup is working yet, if I do id
> <uidnumber>, it
>  comes back with no such user.  If I do id <uid>, it returns the
>  appropriate information from LDAP.  I have not taken the time to figure
>  out why there is a difference.  What happens if you do id <uid>? - John
>     
Hi John

Thanks for the response.

You are right the test should have been id LDilks or id BBuilder

But this also wasn't working

We were specifying uri ldap://distilled.scms.waikato.ac.nz when it 
should be uri ldap://distilled.scms.waikato.ac.nz/

Thanks for the feed back