Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have OpenLDAP server:

@(#) $OpenLDAP: slapd 2.4.23 (Aug  8 2012 16:29:21)

In my configuration have group:

ldapsearch -x -b 'cn=groupname,ou=UnixShell,ou=Services,o=example,c=ru'
# extended LDIF
# LDAPv3
# base <cn=groupname,ou=UnixShell,ou=Services,o=example,c=ru> with scope subtree
# filter: (objectclass=*)
# requesting: ALL

# groupname, UnixShell, Services, example, ru
dn: cn=groupname,ou=UnixShell,ou=Services,o=example,c=ru
cn: groupname
objectClass: groupOfUniqueNames
objectClass: top
uniqueMember: cn=Name Second,ou=Sysadmins,ou=SoftwareDevelopment,ou=IT,ou=Accounts,o=example,c=ru

# search result
search: 2
result: 0 Success

And user

# ldapsearch -x -b 'cn=Name Second,ou=Sysadmins,ou=SoftwareDevelopment,ou=IT,ou=Accounts,o=example,c=ru'
# extended LDIF
# LDAPv3
# base <cn=Name Second,ou=Sysadmins,ou=SoftwareDevelopment,ou=IT,ou=Accounts,o=example,c=ru> with scope subtree
# filter: (objectclass=*)
# requesting: ALL

# Name Second, Sysadmins, SoftwareDevelopment, IT, Accounts, example, ru
dn: cn=Name Second,ou=Sysadmins,ou=SoftwareDevelopment,ou=IT,ou=Accounts,o=
homeDirectory: /home/user
loginShell: /bin/bash
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
shadowLastChange: 15361
shadowMax: 99999
shadowMin: 0
shadowWarning: 7
uid: user
uidNumber: 7000
cn: Name Second
gidNumber: 702

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

A long time i used LDAP authentication on my client servers (CentOS 6.*), but in one time when upgraded to 6.4 branch, my configuration has broke. Because now system default using SSSD.

In pam_ldap was

pam_groupdn cn=groupname,ou=UnixShell,ou=Services,o=example,c=ru
pam_member_attribute uniquemember

But now in sssd.conf it filter does not work

access_provider = ldap
ldap_access_filter = memberOf=cn=groupname,ou=UnixShell,ou=Services,o=example,c=ru

What am I doing wrong? My records can't find when i login through ssh. Works locally "su - user".

Error in sssd log

(Thu Mar 28 12:44:43 2013) [sssd[be[default]]] [sdap_access_filter_get_access_done] (0x0100): User [user] was not found with the specified filter. Denying access.

I'm use it for settings:

authconfig --enablemkhomedir --updateall --enablesssd --enablesssdauth --enableldap --enableldapauth --disablenis --disablekrb5 --disablecachecreds --disablecache  --ldaploadcacert=$certurl"

CentOS release 6.4 (Final)

!!! Do not change anything manually, only system utils !!!

# cat /etc/sssd/sssd.conf 

ldap_uri = ldaps://ldap02.example.ru
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_id_use_start_tls = True
cache_credentials = False

ldap_search_base = o=example,c=ru
krb5_realm = EXAMPLE.COM
krb5_server = kerberos.example.com

id_provider = ldap
auth_provider = ldap
chpass_provider = ldap

access_provider = ldap
ldap_access_filter = uniqueMember=cn=grouname,ou=UnixShell,ou=Services,o=example,c=ru

debug_level = 255
auth_provider = ldap
chpass_provider = ldap
services = nss, pam
config_file_version = 2

domains = default





share|improve this question

I was stuck on this for a long time. It appears that for CentOS6 they changed the config file from /etc/openldap/ldap.conf to /etc/pam_ldap.conf. The pam_groupdn will work if you put your information there.

$ cp /etc/openldap/ldap.conf /etc/pam_ldap.conf

Or you could just create a symbolic link between the two.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.