Adding Non-OS LDAP users?

I have done that before and actually was easier to get the Non-OS users set up than the OS users.

I assume in user_database.xml you have the non-OS user set

I know I did not have authenticate by pam set in iw.cfg

I have seen the GUI come back a bit different as well, typically a comma somewhere messed things up, but I manually fixed the email and it worked.

I have done that before and actually was easier to get the Non-OS users set up than the OS users.

I assume in user_database.xml you have the non-OS user set

I know I did not have authenticate by pam set in iw.cfg

I have seen the GUI come back a bit different as well, typically a comma somewhere messed things up, but I manually fixed the email and it worked.

Yes - we have (I believe - not looking at the file right now)

os="f"

in there.

What did you have for authentication in the iw.cfg?

We don't have a problem with the email - nor with the display name - what we're not getting is the userid, and I think that's the reason it isn't letting us go forward and actually add the user.

Have you verified the connect string ?

First thing I always do it write a perl script to query LDAP and get the fields I am expecting and verify the data is correct. Only those fields I get cleanly are put into the XML config file.

I have no idea what I'm talking about, but...

We are using PAM to configure all of our LDAP users and we don't use user_databases.xml. At all. PAM is configured through the /etc/pam.d/sudo file. When we add a new user, the "add a new user" widget shows all users as "OS" users even though most are not on the box (/etc/passwd), but are coming from PAM.

Just throwing that in there since our setup works, but the consultants set it all up, so I don't understand it very well.

calendar report 3.rptdesign

PAM users show up as OS users, both in the GUI and the functionality. For LDAP without PAM, you need to have user database set to query LDAP.

Here's a diagram of our setup, if this helps at all.

PAM users show up as OS users, both in the GUI and the functionality. For LDAP without PAM, you need to have user database set to query LDAP.

He said this:

iw.cfg
is setup to authenticate via
pam,file

So I assumed he was using PAM and not LDAP, which in and of itself is confusing as ****. But I know what happens when I assume....

Yea he is quite confused as it is.

I thought he was using PAM but they wanted to move to LDAP and have non-OS users.

wrapping.png

The consultants we hired, who are pretty smart, were pulling their hair out trying to configure PAM. The IW documentation on configuring PAM is horrendous (shocking, I know). It took forever for them to get it working.

He said this:
iw.cfg
is setup to authenticate via
pam,file

So I assumed he was using PAM and not LDAP, which in and of itself is confusing as ****. But I know what happens when I assume....

Slight correction - it says

pam,local

I'm still working with the customer on this, and I've also opened a support case.

For those of you who like to take snipes at Support - maybe you should be a little nicer and/or optimistic:

First, the search key value for AD is not uid, it is samAccountName. So, that entry should be:
<search_key value=”samAccountName”/>

That should resolve the issue of the missing user ID.

However, you currently have TS configured for PAM authentication. Since the server itself is configured to authenticate AD users as local users, you cannot set 'os=f'. User names in Unix MUST be unique. If you try to add a non-OS user with the username jsmith and there is a local user named jsmith, the operation will fail. I'm a little confused by the configuration there because if they're using PAM authentication, those users should NOT exist in the local /etc/passwd file. PAM is usually used for authenticating users that exist in a remote LDAP database.

So, if this LDAP database is the same AD DB that you've configured for TS (as non-OS users), you won't be able to add those users as non-OS. If they really want to add non-OS users, then the LDAP DB that they use for this must contain users that are not in /etc/password NOR in the LDAP database that the Linux server can access via PAM.

A few points to augment the above:

For those of you who like to take snipes at Support - maybe you should be a little nicer and/or optimistic

Even a blind dog finds a bone once in a while...

Smiley Very Happy

Even a blind dog finds a bone once in a while...

And a blind fish finds a smaller fish.......

Even a blind dog finds a bone once in a while...:-)
And a blind fish finds a smaller fish.......

Are you guys trying to say I have problems seeing? ;-)