4

On a LDAP client, there are two users having the same username, say "abc". One is the local user with UID 1000, another is the LDAP user with UID 1001. If I run getent passwd 1000, the returned output is

abc:x:1000:1000:Local User:/home/abc:/bin/bash

If I run getent passwd 1001, the returned output is

abc:x:1001:100:LDAP User:/home/abc:/bin/bash

The home directory is stored in a NFS server and the files in my home directory are all created by LDAP user, so the UID's of home files are all 1001. "files" goes before "ldap" in the passwd, group and shadow field of /etc/nsswitch. In my understanding, this order means that the LDAP client checks local database first and therefore it is local user of abc that is used. As a result, when I run command ls -al ~, since the owner UID's of the home files are 1001, which cannot be mapped to local user "abc" because of UID mismatch, the owners of the output of the above ls command should be the number 1001 (it is the case when LDAP client is not configured). However, the actual output are correctly "abc". So, I don't understand why this happens. How does the LDAP mechanism manage to resolve duplicated username on a LDAP client when I explicitly specified that "files" goes before "ldap"?

The LDAP machine is running Ubuntu 22.04.3 LTS server.

1 Answer 1

8

getpwnam(3) used to resolve abc to a number, like by login after you enter your username will query files first and find it there with uid 1000 and gid 1000 so stop there. initgroups(3) will iterate over all the groups in all databases (but again respecting the order in nsswitch.conf) and add the gid to the list of supplementary gid for each group that mentions abc as a member.

ls -l does the reverse, it looks for a username given a uid number. Using getpwuid(3), but the process is the same. To find a username corresponding to uid 1001, it will first query the files db and if no username has that uid there, qery LDAP next. If there's no username with uid 1001 in /etc/passwd, you'll get the first username in the ldap db with uid 1001.

So on your system, I'd expect:

  • abc to resolve to 1000 via files
  • 1000 to resolve to abc via files
  • 1001 to resolve to abc via ldap.

Usernames in the account DB should be the primary key, so two usernames with different attributes is a pathological case which should be resolved (here likely by removing the entry in /etc/passwd).

Having two user names for a same uid is OK but less common these days and some software such as sudo don't play well with that, so is generally best avoided as well.

2
  • There are also complications with caching daemons like nscd or sssd which might cause getpwnam() calls to be non-deterministic, depending on if the 1000 or 1001 entry is in the cache (and if nsswitch is configured to use the cache, which is not uncommon in an LDAP setup). Dec 24, 2023 at 14:38
  • One test you can run - if you create a local user def with 1001, you should find that one before you find the LDAP abc. Dec 24, 2023 at 22:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .