Ubuntu LDAP Client Config

The below is copied from the blog devnotcorp
It’s the simplest way I have found enabling LDAP authentication for Ubuntu. I have tested it on Ubuntu 13.04

1. sudo apt-get install libnss-ldap libpam-ldap ldap-auth-config

Installs auth-client-config ldap-auth-client ldap-auth-config libnss-ldap libpam-ldap and configures /etc/ldap.conf.
During install the following settings can be configured:

Should debconf manage LDAP configuration? Yes
LDAP server Uniform Resource Identifier: ldapi://ldap.mydomain
If you see errors like the following in your /var/log/auth.log, try to change ldapi to ldap:
May 10 12:47:30 sonar getent: nss_ldap: could not connect to any LDAP server as (null) – Can’t contact LDAP server
May 10 12:47:30 sonar getent: nss_ldap: failed to bind to LDAP server ldapi://ldap.mydomain: Can’t contact LDAP server
May 10 12:47:30 sonar getent: nss_ldap: could not search LDAP server – Server is unavailable
Distinguished name of the LDAP search base: dc=mydomain,dc=com
LDAP version to use: 3
Make local root Database admin: No
Does the LDAP database require login? No
Local crypt to use when changing passwords: md5

You can reconfigure the settings later on with
sudo dpkg-reconfigure ldap-auth-config

2. sudo auth-client-config -t nss -p lac_ldap

Configures /etc/nssswitch.conf.

3. sudo pam-auth-update

Configures /etc/pam.d/common-session.
Select the authentication methods to enable.

Now you can login to this client using your username and password stored in the LDAP directory, but you have no homedir.

So add this line to /etc/pam.d/common-session:

4. session required pam_mkhomedir.so skel=/etc/skel/ umask=0022

Creates homedir for user if it doesn’t exist.

To be able to type in user name during login (found as a comment for another LDAP client configuration)

5. sudo /usr/lib/lightdm/lightdm-set-defaults -m true

That’s it 🙂

Leave a Reply