I am trying to configure libnss-ldap to provide AD authentication to my Linux Debian servers. This is working fine if user exists locally, I want to make it work for Domain users.
Here is my /etc/ldap.conf file content:
host $AD_IP
base ou=Users,dc=MY,dc=DOMAIN
uri ldap:///$AD_IP
ldap_version 3
binddn $user@MY.DOMAIN
bindpw $password
pam_filter objectclass=user
nss_base_passwd ou=Users,dc=MY,dc=DOMAIN
nss_map_objectclass posixAccount User
nss_map_objectclass shadowAccount User
nss_map_attribute uid sAMAccountName
nss_map_attribute uniqueMember Member
nss_map_attribute homeDirectory unixHomeDirectory
nss_map_objectclass posixGroup Group
pam_login_attribute sAMAccountName
pam_filter objectclass=User
pam_password ad
Here is my /etc/nsswitch.conf
passwd: compat ldap
group: compat ldap
shadow: compat ldap
...
When I enter the command
getent passwd
The output is the local /etc/passwd file. But tcpdump shows that the request is correctly made to the AD and the AD returns the whole list of users. I think data retrieve by the getent command are incorrectly interpreted (nss_map_* incorrectly configured?) and hence getent finally returns local informations (nsswitch first tries ldap then compat).
How to correct this /etc/ldap.conf configuration to make it work?
Many thanks