Get all Ldap User list on client with (getent passwd) command

Question

I have open ldap server and client both on centos6. I need all the list of open ldap user on client side in (/etc/passwd)

Answer 1

I'm not sure I understand your question correctly, but I assume you want to let the system know the users stored in LDAP.

To achieve this you have to tell the nsswitch system how to collect user info. Edit the /etc/nsswitch.conf file from

   passwd:         compat
   group:          compat
   shadow:         compat

to:

   passwd:         compat ldap
   group:          compat ldap 
   shadow:         compat ldap

This way you tell the system to search first in the local database (e.g. the group, passwd and shadow files) then search in ldap. Of course you need properly working LDAP environment, otherwise the system can't find the ldap data. You need the nss_ldap package to get the ldap feature for nss. If you didn't do that already, you have to configure the LDAP system in /etc/ldap.conf or /etc/ldap/ldap.conf and/or /etc/openldap/ldap.conf according to your LDAP environment. For example:

BASE    dc=somesite,dc=com
URI     ldap://my.ldap.server.somesite.com
TIMELIMIT       10

You may prefer your centos tool system-config-authentication (Information / Enable LDAP Support) to do this.

After that you should be able to access the user ids by issuing getent passwd.

Alternatively you may want to use sssd to act as a middleman to contact ldap as documented here: https://wiki.contribs.org/Client_Authentication:Centos_via_sssd/ldap

Additional info:

• If you are using some name switch caching software (like sssd or nslcd) you must update that config (if needed) and restart the service.
• at a crowded site constantly querying LDAP can be overkill. You can mitigate the problem using the aforementioned caching softwares (nslcd).
• getting passwd/group info from LDAP and authentication are completely different species. If you want to authenticate against ldap you must change the PAM setting. That's a different story.