[Samba] Cannot bind to AD using nslcd

[Rowland Penny]

On 19/11/14 16:16, Rob Mason wrote:
> Thanks Rowland, but that space is pasted into my email by accident - it
> isn't in the original nslcd.conf file.
>
> Checked again and re-pasted:
>
> binddn cn=nslcd-connect,cn=Users,dc=acasta,dc=intra
>
> Is this definitely the correct format for 'binddn' - the man page doesn't
> specify format???

It has been some time since I used nslcd, but I believe it is correct.

Have a look here, this may help: 
http://wiki.gentoo.org/wiki/Centralized_authentication_with_Samba_AD_/HOWTO

If it does and you get it working, can you post what you changed and if 
required, I will update the howto.

Rowland
>
>
> -----Original Message-----
> From: samba-bounces at lists.samba.org [mailto:samba-bounces at lists.samba.org]
> On Behalf Of Rowland Penny
> Sent: 19 November 2014 16:10
> To: samba at lists.samba.org
> Subject: Re: [Samba] Cannot bind to AD using nslcd
>
> On 19/11/14 15:54, Rob Mason wrote:
>> Hi Again - following on from my last request for help, I'm now
>> attempting to setup LDAP auth against my working samba4 AD.
>>
>> Simplistically, I'm trying initially to SSH into my AD server
>> (working) using nslcd.
>> I've tried method #1 from
>> https://wiki.samba.org/index.php/Local_user_management_and_authenticat
>> ion/ns
>> lcd
>>
>> My simple config is:
>>
>>     uid nslcd
>>     gid nslcd
>>     uri ldap://127.0.0.1:389
>>     base cn=Users,dc=acasta,dc=intra
>>     binddn cn=nslcd-connect,cn=Users, dc=acasta,dc=intra
>                                                       ^
>                                      You have a space here
>
> Rowland
>
>>     bindpw xxxxx
>>
>>     filter  passwd  (objectClass=user)
>>     filter  group   (objectClass=group)
>>     map     passwd  uid                sAMAccountName
>>     map     passwd  homeDirectory      unixHomeDirectory
>>     map     passwd  gecos              displayName
>>     map     passwd  gidNumber          primaryGroupID
>>     #map     group   uniqueMember       member
>>
>> Nsswitch.conf has been modified to include ldap.
>> Pam.conf has the appropriate values.
>>
>> My syslog says:
>>     Nov 19 14:32:35 kepler nslcd[13159]: [8b4567] <passwd(all)> failed
>> to bind to LDAP server ldap://kepler.acasta.intra/: Invalid
>> credentials: Simple Bind
>> Failed: NT_STATUS_LOGON_FAILURE
>>     Nov 19 14:32:35 kepler nslcd[13159]: [8b4567] <passwd(all)> no
>> available LDAP server found: Invalid credentials
>>
>> # ldapsearch -x -D 'ACASTA\nslcd-connect' -w 'xxxxx' -E
>> pr=1000/noprompt -b 'cn=Users,dc=acasta,dc=intra' SAMAccountName uid
>> uidNumber
>>    
>> .authenticates and lists all my user objects
>>
>> I've convinced myself that the problem somehow lies within the 'binddn'
>> setting. After several hours I'm no further forward.
>>
>> Can anyone throw any light here???
>>
>> TIA
>>
>>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba