Jamie McKnight wrote: >>>in /etc/ldap.conf, and that your pam stack is set up for pam_ldap >>>authentication. Also, if you are using a proxy agent, the proxy agent >>>must not be able to see the userPassword attribute, or you will end up >>>authenticating via pam_unix, and not pam_ldap. >> >>This could be the problem. I am using a proxy and not sure how to test >>what you are saying. If I do an ldasearch such as: >> >>ldapsearch -x -ZZ '(uid=tulsa)' >> >>then that should bind via the entries in ldap.conf hence use the >>config'd proxy, correct? Then if that search shows a userPassword then >>that would confirm pam_unix usage? Not sure how to stop it if it is >>using pam_unix? >> > > > That's correct, if you can do a ldapsearch and bind as the proxyagent > and you see the userPassword attribute returned, then the directory > server has an ACI that allows read for your proxy agent of the > userPassword attribute. You can just remove that ACI and it should at > that point not return the userPassword field, and pam_ldap > authentication would take place then. > > For example: > > ldapsearch -x -h ldapsrv -D "cn=proxyid,dc=blah" -W -b > "ou=people,dc=blah" uid=tulsa > > Where -D is the id listed as proxyagent in ldap.conf, and the password > supplied is for that id. If userPassword is returned then you know what > is going on. > > If this is not what is happening, check and make sure you don't have > rootbinddn and /etc/ldap.secret set up. If it is actually binding as > your rootdn then that is what it could be as well. Welp, I am stumped. Running various ldapsearchs I got the results as they should be. Binding as the proxy, no userPassword, binding as an admin then I get the userPassword. I looked in /etc/ and there is not an ldap.secret file, so I guess I do not have the rootbinddn setup. I was thinking of removing the shadowExpire attributes but I am afraid if I do that then cron may stop working. Not sure at this point. Thanks, jim > > > Jamie > > -- > Fedora-directory-users mailing list > Fedora-directory-users at redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users -- Jim Summers School of Computer Science-University of Oklahoma -------------------------------------------------
