There is a feature in pam_ldap that enables the OS to authenticate the
user only in the case, when the user is a member of a certain group.
This feature is called pam_groupdn.
But this only works, if the memberUid's value (in the ldap group) is
the users full cn, instead of the form used in MDS (the uid only).
If I change manually the value of the memberUid in the group to be,
for example, "uid=labadim,ou=Users,dc=example,dc=com", then the
pam_groupdn feature is working as expected.
Here is the relevant part of my /etc/ldap.conf (this file is
/etc/libnss-ldap.conf in Debian systems)
pam_login_attribute uid
pam_groupdn cn=blade1528,ou=Groups,dc=example,dc=com
pam_member_attribute memberUid
And I also checked the relevant code from pam_ldap.c from
http: //www.padl.com/download/pam_ldap.tgz. And it really checks for
userdn instead of the uid:
"
/* group auth, per Chris's pam_ldap_auth module */
if (session->conf->groupdn != NULL)
{
rc = ldap_compare_s (session->ld,
session->conf->groupdn,
session->conf->groupattr,
session->info->userdn);
if (rc != LDAP_COMPARE_TRUE)
{
snprintf (buf, sizeof buf, "You must be a %s of %s to login.",
session->conf->groupattr, session->conf->groupdn);
_conv_sendmsg (appconv, buf, PAM_ERROR_MSG, no_warn);
return PAM_PERM_DENIED;
}
else
rc = success;
}
"
Is there any special requirements, why the users uid is in the
memberUid instead it's cn?
If yes, do you guys know any workaround (beside changing memberUid's
uid to cn manually).
Thanks in advance,
Mate Labadi
labadimate@freemail.hu
