arch openldap认证失败

Question

我设置了openldap，一切看起来都很好，但我无法设置身份验证，

#getent shadow | grep user                         
user:*:::::::
tuser:*:::::::
tuser2:*:::::::

#getent passwd | grep user
git:!:999:999:git daemon user:/:/bin/bash
user:x:10000:2000:Test User:/home/user/:/bin/zsh
tuser:x:10000:2000:Test User:/home/user/:/bin/zsh
tuser2:x:10002:2000:Test User:/home/tuser2/:/bin/zsh

从root我可以作为其中一个用户登录

#su - tuser2
su: warning: cannot change directory to /home/tuser2/: No such file or directory
10:24 tuser2@juliet:/root

我不能通过ssh登录，passwd也不能工作。

#ldapwhoami -h 192.168.10.156 -D "uid=user,ou=People,dc=xcl,dc=ie"
ldap_bind: Server is unwilling to perform (53)
    additional info: unauthenticated bind (DN with no password) disallowed
10:30 root@juliet:~
#ldapwhoami -h 192.168.10.156 -D "uid=user,ou=People,dc=xcl,dc=ie" -W
Enter LDAP Password: 
ldap_bind: Invalid credentials (49)

我输入的密码是正确的

/etc/openldap/slapd.conf访问dn.base=“by * read access to dn.base=”cn=Subschema

access to *
  by dn="uid=root,ou=Roles,dc=xcl,dc=ie" write
  by users read
  by anonymous auth
access to attrs=userPassword,gecos,description,loginShell
  by self write

access to attrs="userPassword"
  by dn="uid=root,ou=Roles,dc=xcl,dc=ie" write
  by anonymous auth
  by self write
  by * none
access to *
  by dn="uid=root,ou=Roles,dc=xcl,dc=ie" write
  by dn="uid=achmiel,ou=People,dc=xcl,dc=ie" write
  by * search

access to attrs=userPassword
  by self =w
  by anonymous auth
access to *
  by self write
  by users read

database        hdb
suffix          "dc=xcl,dc=ie"
rootdn          "cn=root,dc=xcl,dc=ie"
rootpw          "{SSHA}AM14+..."

该conf文件/etc/openldap/ldap.conf的某些部分如下所示：

BASE dc=xcl,dc=ie
URI ldap://192.168.10.156/
TLS_REQCERT  allow
TIMELIMIT    2

所以我的问题是，我错过了什么ldap不允许我使用密码登录？

Answer 1

好的，我通过删除ACL的查询来解决这个问题

access to *
  by dn="uid=root,ou=Roles,dc=xcl,dc=ie" write
  by users read
  by anonymous auth
access to attrs=userPassword,gecos,description,loginShell
  by self write

access to attrs="userPassword"
  by dn="uid=root,ou=Roles,dc=xcl,dc=ie" write
  by anonymous auth
  by self write
  by * none
access to *
  by dn="uid=root,ou=Roles,dc=xcl,dc=ie" write
  by dn="uid=achmiel,ou=People,dc=xcl,dc=ie" write
  by * search

我做了更多的更改，但无论如何，这些更改不会解决这个问题，直到我删除了提到的ACL的