1

Currently using winbind, but looking to switch to pam_ldap.

Does pam_ldap have the ability to take a uid on the fly like winbind does (from a pool of numbers) and cache it locally during use ?

The documentation makes no mention of such an ability, but adding the unix uid/gid attributes to every user in the ldap repository isn't desirable (as its AD, and largely windows users)

Sirex
  • 5,447
  • 2
  • 32
  • 54

1 Answers1

3

What you're looking for is 'nscd' (name server caching daemon), it's a part of the glibc tree source and is a standard part on most systems. In many cases all you need to do is install the package and start the daemon, it's preconfigured to cache everything and work with pam_ldap. On a Red Hat/CentOS system you can run 'authconfig' and see there's a checkbox option to do it all for you - enable LDAP and caching, it'll write your configs.

Now, for your on-the-fly uid/gid concept, what I think you're looking for is the pam_ldap option 'pam_login_attribute' (default: uid) and 'pam_member_attribute', possibly 'pam_filter' too. 'pam_login_attribute' is what controls the lookup against their logon name if you need to tweak it.

  • This appears to be a really useful answer - I'll try all the things mentioned. Thanks ! – Sirex Dec 29 '10 at 11:06
  • can't for the life of me get openldap working, At least without applying schema updates against AD, which isnt possible. lol. failbeans ! :( – Sirex Dec 30 '10 at 15:49