I am trying to setup Kerberos MIT authentication with OpenLdap autorisation on Debian Jessie.

Authentication part is working great, as I can login to SSH using my kerberos account.

I even can create user home directory using pam_mkhomedir.so

However, I can't use Ldap posixGroup to allow access to my SSH server :

Here is the output of getent group

getent group | grep tupac

Here is the extract of sshd_config :

AllowGroups adminsLinux

Here are the log files :

sshd[3305]: User tupac from a.b.c.d not allowed because not in any group
sshd[3305]: input_userauth_request: invalid user tupac [preauth]
sshd[3305]: Connection closed by a.b.c.d [preauth]

Here is id tupac output

uid=20003(tupac) gid=20003 groups=20003

tupac user is not part of any Unix group, but I want to allow access based on OpenLdap posixGroup. I have thought /etc/nsswitch.conf configuration and getent group resolution would be enough to grant access according to posixGroups.

1 Answer 1


uid=tupac,ou=people,dc=maytacapac,dc=inc looks wrong, as most (okay, all except this one) LDAP-provided group memberships I've seen do not include a LDAP DN, and instead just the username, so I would expect to instead see adminsLinux:*:3000:tupac.

  • 1
    +1. also, commas are used to separate usernames for entries in the groups db (whether from /etc/group or elsewhere).
    – cas
    Apr 22, 2016 at 3:49
  • ok thank you thrig; indeed putting uid value for memberUid makes more sense and solved the issue. I however had to reload nscd as well as the erroneous content was cached for a (short) while. Many thanks again
    – philippe
    Apr 22, 2016 at 9:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .