LDAP authentication

[ozas]

Hi all,
Please can someone help me with how to configure two servers for PAM_LDAP. The configuration works perfectly well with one server but I need to include another LDAP server so that authentication can be done from either one.
Thanks.

[Hakki Aydin Ucar]

Hi,

Check this link out:

http://docs.hp.com/en/B3921-60631/pam_ldap.5.html

http://ldots.org/ldap/

[ozas]

Hi Hakki,
The link does not contain any information about using two servers for PAM_LDAP.

[Don Mallory]

Hi there,

Using the authconfig TUI (or GUI) is just an exercise in frustration. It can reduce some of the work, but not much.

I'm assuming that you have it working with one authentication LDAP server, and you've set up a "redundant" server that is doing some sort of replication with the primary.

In your /etc/openldap.conf, you should be able to define a second server. Typically it's a failover model, much like a DNS failure. Whatever you do, don't use your DNS servers as your LDAP servers, as you will need to wait for the DNS queries to fail over as well and it will make logins very slow.

[ozas]

Hi Don,
Thanks for the suggestions.
What happen to my configuration using the authoconfig-tui.
I have made the changes to the file /etc/ldap.conf putting the two servers but this did not have any effect whatsoever.
See details below:

Edit /etc/ldap.conf

# Your LDAP server. Must be resolvable without using LDAP.
# Multiple hosts may be specified, each separated by a
# space. How long nss_ldap takes to failover depends on
# whether your LDAP client library supports configurable
# network or connect timeouts (see bind_timelimit).
#host 127.0.0.1

gbahevl234 gblabvl61

Are there any special way of making this entries.

[Don Mallory]

It's been a while since I've done this, but according to the MAN page on ldap.conf, you should use a URI of the format:

URI

Such as:

URI ldap://mynonsslldapserver1:389 ldap://mynonsslldapserver2:389 ldaps://mysslldapserver1:636 ldaps://mysslldapserver2:636

This would give you 2 servers for each of ldap (plain text) and ldaps (over ssl).

Best regards,
Don