Home / server / Questions / 406164
In Process
cswingle
Asked: 2012-07-10 11:45:55 +0800 CST

LDAP groups not always mapping, Ubuntu server 12.04

  • 772

Ubuntu 12.04 server, AMD64, authentication via LDAP. I'm having trouble getting the LDAP groups to map to my user account when logging in, even though 'getent group' shows the correct set of groups assigned to my account. More confusingly, sometimes it works, and other times it doesn't.

For example, here's my current login:

$ ssh zoyd
$ id
uid=522(cswingley) gid=513(Domain Users) groups=513(Domain Users), \
4(adm),24(cdrom), 27(sudo),30(dip),46(plugdev),111(lpadmin), \
112(sambashare)

But:

$ getent group | grep cswingley | sort -t : -n -k3 | \
  awk 'BEGIN {FS=":"} {printf("%s(%s)\n", $3, $1);}' | \
  xargs | sed 's/) /),/g'
4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),111(lpadmin), \
112(sambashare),500(level2),502(gis),503(level3), \
504(management_accounting),544(Administrators),606(abruser),\
619(proposal),621(project_managers),700(unixadmin),\
701(ntadmin),1000(cswingley)

This happens about half the time I log in. The other times, all my groups (both local and LDAP) are mapped successfully. getent group always shows the correct list.

I believe this is also happening to my Samba users, which will often prevent them from getting to shares or directories restricted to certain Unix / Samba groups. It also prevents me from joining computers to my domain because LDAP isn't assigning me to the group with that power (ntadmin).

The only thing I see in the slapd logs (currently set to loglevel 256) that looks suspicious is this, but I'm not sure if it's related:

conn=8570 op=1 SRCH base="dc=abrinc,dc=com" scope=2 deref=0 \
  filter="(&(objectClass=posixAccount)(uid=cswingley))"
conn=8570 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
conn=8570 op=2 DISCONNECT tag=101 err=2 text=controls require LDAPv3
conn=8570 op=2 do_search: get_ctrls failed
conn=8570 fd=57 closed (operations error)

Here's a list of the packages with 'ldap' in their name, currently installed on the server:

$ sudo dpkg --list '*ldap*' | grep '^i' | \
  sed 's/^[^ ]* *\([^ ]* *[^ ]*\).*/\1/'
ldap-auth-client                 0.5.3
ldap-auth-config                 0.5.3
ldap-utils                       2.4.28-1.1ubuntu4
libldap-2.4-2                    2.4.28-1.1ubuntu4
libnet-ldap-perl                 1:0.4300-2ubuntu1
libnss-ldap                      264-2.2ubuntu2
libpam-ldap                      184-8.5ubuntu2
smbldap-tools                    0.9.7-1ubuntu1
sudo-ldap                        1.8.3p1-1ubuntu3.3

Update: I also tried installing the libnss-ldapd and libpam-ldapd packages (to replace the non-*d versions above), but that doesn't resolve the issue either.

Edit: their is an opened bug for this issue on Ubuntu bug tracker : https://bugs.launchpad.net/ubuntu/+source/openldap/+bug/1023025

ubuntu ldap openldap

0 Answers