sssd as a replacement for nss /pam ldap configuration

[houston]

We are running sssd in place of nscd on our rhel5 servers and in place of nslcd on our
rhel6 servers.  

On our rhel5 boxes there appears to be a dependency on the legacy nss_ldap package and our
/etc/ldap.conf .   

I am curious if this is due to a lack of configuration of our sssd.conf or if it is common
to keep all these different modules to keep ldap authentication working.

thx, 
H

[Jakub Hrozek]

On Wed, Feb 06, 2013 at 12:52:23AM -0600, houston wrote:
>  We are running sssd in place of nscd on our rhel5 servers and in
> place of nslcd on our rhel6 servers.  
>  
>  On our rhel5 boxes there appears to be a dependency on the legacy nss_ldap package and
> our /etc/ldap.conf .   
>   
What kind of dependency? On the RPM level? Or just that some part of
functionality is not working when you remove ldap.conf and/or nss_ldap ?

>  I am curious if this is due to a lack of configuration of our
> sssd.conf or if it is common to keep all these different modules to keep ldap
> authentication working.
>   
No, you shouldn't need nss_ldap at all. In general you need to configure
nsswitch.conf to use the sss module and PAM to use the pam_sss.so
module, those two components would handle identity information and
authentication respectively.

You can refer to the existing RHEL5 documentation such as:
https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/5...

https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/5...