0

I'm using openldap + nslcd to connect to a LDAP server for authentication of some users (these users would want their passwords and most of their configuration shared over many devices). I don't control the LDAP server.

However, the synchronization came after the users already had dual accounts, so names of home folders don't match (and it's not wise to move them due to possible hardcoded paths in their scripts). I'm considering a hard linked directory, but I want to know if there is a way to override home folder for a specific user, which seems cleaner and sounds like it should be a common use case.

I was unpleasantly surprised that nslcd.conf seems to accept only a single filter (per map=passwd), and map directives will simply replace the home for all users at once.

Is there a way around to elegantly "fix" single entries after LDAP lookup? My search mostly encountered answers that replace the pattern for all users, or give unhelpful answers (such as this one which simply overrides the previous filter).

What I think I need:

filter passwd (&(objectClass=inetOrgPerson)(<redacted>))
# the last part is wishful thinking, not actual syntax
map passwd homeDirectory "<redacted>" if (uid=<redacted>)

I'm new at LDAP so it's possible I don't entirely understand the order in which the transactions happen and whether it's PAM or nslcd that should do this. I realize this is not the best way to handle the situation properly, but I'd still like to know if it can be done.

1

I think you cannot implement individual overrides with map directive in nslcd.conf(5). Such a mapping is applied to whole passwd map. However depending on the order of module names in /etc/nsswitch.conf you could set a local passwd entry with different home directory which has higher precedence in file /etc/passwd.

Example line in /etc/nsswitch.conf:

passwd: files ldap

Make sure to keep rest of attributes consistent!

IIRC newer version of sssd has a CLI tool sss_override(8) which allows to set individual values for certain users.

But ask yourself: Do you really want to maintain that mess?

Being you I'd first talk to the users that they should rather use env var $HOME in their scripts instead.

  • Thank you for the info around the sssd option, I'll keep it in mind, it'll come useful some day. The nsswitch.conf will be a nice patch for transition period, before we eventually iron out the mess. – orion Mar 29 at 18:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.