LDAP-UX Authentication and User Information

[Greg Wojtak]

I have been working on getting our UNIX servers set up to authenticate and get user information from our NDS tree. So far it is working on our Solaris and Linux systems and is mostly working. The only thing that does not seem to work is secondary groups. Running 'groups user' only shows the primary group and secondary groups that the user belongs to via /etc/group. An LDAP user's primary group will show as well, and those groups are all in NDS. So primary groups via LDAP are working. A 'getent group groupname' using a groupname from LDAP also shows that the groups do exist. I'm just not sure why a groups or id do not seem to show this. I have verified that it is actually causing problems by trying to use groups in sudo and with file permissions.

Just wondering if anyone else has had this problem.

[RAC_1]

How your nsswitch.conf looks like??

[Greg Wojtak]

passwd: files ldap
group: files ldap
hosts: files [NOTFOUND=continue] dns
services: files
networks: files
protocols: files
rpc: files
publickey: files
netgroup: files
automount: files
aliases: files

I don't think this is the problem. As I said in my original post, it appears to be getting the group information fine, it just looks like it is breaking down while assigning users their secondary groups that reside in LDAP.

[RAC_1]

Does the group file lists the secondary group for the user??

Anil

[Greg Wojtak]

Local groups are resolved correctly, if that's what you mean. So if I have an LDAP user gwojtak who's primary group is sysadmin, and secondary local group is users. gwojtak also has a secondary LDAP group of gwojtak. groups output shows:

# groups gwojtak
sysadmin users

On our Solaris and Linux servers, it comes back:
gwojtak sysadmin users

[RAC_1]

Can you compare the group files of linux and solaris where it works. also there nsswitch.conf files.