1

I have configured an openLDAP server with LDAP user and group ids beginning at 10000. My client successfully binds to the LDAP server via ldapsearch. Additionally, getent passwd|group returns a full list of local and remote (LDAP) users|groups. My local user on the client, johndoe (uid=1000), also exists in the LDAP directory as uid 10000. The overlapping local and LDAP users (only the usernames are common) have different passwords.

Scenario 1: On my Linux Mint 17 client, when logged in as johndoe via the Cinnamon desktop, the id -G and id -G <user> commands returns a different set of groups:

$ whoami
johndoe

:~$ id -G
1000 4 7 24 27 30 33 46 100 112 118 119

:~$ id -G johndoe
1000 4 7 24 27 30 33 46 100 112 118 119 10000 10001 10002 10003 10005 10006 10007 10008 10004 10009 10010

Note the gids > 10000 are from the LDAP directory and they only appear when the username is explicitly specified.

Scenario 2: After switching users to the remote johndoe account (authenticating with the LDAP password), the effective and real IDs match:

:~$ whoami
johndoe

:~$ su johndoe
Password: 

:~$ whoami
johndoe

:~$ id -G
1000 4 7 24 27 30 33 46 100 112 118 119 10000 10001 10002 10003 10004 10005 10006 10007 10008 10009 10010

:~$ id -G johndoe
1000 4 7 24 27 30 33 46 100 112 118 119 10000 10001 10002 10003 10005 10006 10007 10008 10004 10009 10010

Under the first scenario, my CIFS network shares, which have been configured for access by LDAP users and groups only, cannot be read. However, after switching users as shown in the second scenario, these same shares are accessible as originally envisioned.

As I'm new to LDAP, my ignorance is undoubtedly on full display with this post. That said, what are the best practices for overlapping local and remote usernames (i.e. don't do it, keep separate uids, combine passwords, etc...), and how can I configure my client to use the LDAP groups by default - thereby avoiding the second login?

FWIW, /etc/nsswitch.conf on the client contains:

passwd: files ldap
group: files ldap
shadow: files ldap

Client kernel:

:~$ uname -a
Linux my-client 3.13.0-24-generic #47-Ubuntu SMP Fri May 2 23:30:00 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
  • Since asking the above question, I've changed my local and LDAP passwords to match and learned to pause briefly at the initial login screen (approx 20 sec.) to allow LDAP communication to complete. After these changes, my local user correctly inherits the LDAP groups as expected. However, if I don't allow time enough for LDAP communication to complete, my username only receives the local groups (which logging out and back in corrects). Off to install and configure nscd! – rhp997 Nov 19 '14 at 0:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.