How to authenticate through LDAP in pam?

Question

I have a application (Webmin) which has to authenticates user throught LDAP on rhel5, 6 and 7.

The package nss_ldap and even more its equivalent nss-pam-ldapd on rhel7 does not allow to get users not listed through getent passwd.

I used to think that for authenticating users in LDAP, we were trying to get a connection using the correct user distingish name and provided password.

Does a module pam that authenticates against LDAP exists without imposing those users to be system user too exists? Why should I not use such an authentication for Web applications?

Answer 1

Yes, such a module does exists. It is called pam_ldap and is installed either with package nss_ldap or nss-pam-ldap following your Linux version. When installing those packages you mujst configure either file /etc/ldap.conf or /etc/nslcd.conf.

Make sure service nslcd (RHEL7) is up and running.

For authenticating in Webmin via LDAP, your must have option pam selected to one pam module (let's consider webmin). Let other option as normal.

Edit /etc/pam.d/webmin for replacing the followings :

auth required pam_ldap.so 
session required pam_ldap.so
account required pam_ldap.so 

You may want to keep comments but consider removing others meaningful lines.

If you make this each user whom password is x in /etc/webmin/miniserver.users is authenticated through LDAP instead of the Webmin way.