ldapsearch返回结果，但getent不返回。

Question

我正在设置一个新的CentOS 7服务器，用于并需要设置LDAP身份验证，也就是说，已经存在一个对用户进行身份验证的服务器，我们在其他GNU服务器上使用该服务器。

例如，在Windows中，我可以使用nltest /dclist:X.Y查询DC的主机名和IP。它返回一个DC服务器列表，我可以确认它是正确的。

当我在ldapsearch 7服务器上使用CentOS测试到这些DC服务器的连接时，它工作如下：

ldapsearch -H ldap://<DCSERVER> -D <user>@X.Y -w

输出是一长串信息，包括DN信息。

但是，在使用getent passwd时，没有输出，我在/var/log/messages中看到了错误：

Nov 24 16:09:37 XXXXXXXX nslcd[22440]: [16e9e8] <passwd(all)> ldap_result() failed: Operations error: 000004DC: LdapErr: DSID-0C09072B, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580

getent password在其他CentOS 6服务器上运行得很好，但是它们使用的是BeyondTrust，我想迁移到这里，在安装时我不是管理员。

相关配置文件：

/etc/openldap/ldap.conf包含：

#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

#BASE   dc=example,dc=com
#URI    ldap://ldap.example.com ldap://ldap-master.example.com:666

#SIZELIMIT      12
#TIMELIMIT      15
#DEREF          never

TLS_CACERTDIR /etc/pki/tls/certs

# Turning this off breaks GSSAPI used with krb5 when rdns = false
SASL_NOCANON    on
URI ldap://<DCSERVER>
BASE DC=X,DC=Y

/etc/nsswitch.conf协约：

#
# /etc/nsswitch.conf
#
# An example Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
#
# The entry '[NOTFOUND=return]' means that the search for an
# entry should stop if the search in the previous entry turned
# up nothing. Note that if the search failed due to some other reason
# (like no NIS server responding) then the search continues with the
# next entry.
#
# Valid entries include:
#
#       nisplus                 Use NIS+ (NIS version 3)
#       nis                     Use NIS (NIS version 2), also called YP
#       dns                     Use DNS (Domain Name Service)
#       files                   Use the local files
#       db                      Use the local database (.db) files
#       compat                  Use NIS on compat mode
#       hesiod                  Use Hesiod for user lookups
#       [NOTFOUND=return]       Stop searching if not found so far
#

# To use db, put the "db" in front of "files" for entries you want to be
# looked up first in the databases
#
# Example:
#passwd:    db files nisplus nis
#shadow:    db files nisplus nis
#group:     db files nisplus nis

passwd:     files ldap
shadow:     files ldap
group:      files ldap
#initgroups: files

#hosts:     db files nisplus nis dns
hosts:      files dns

# Example - obey only what nisplus tells us...
#services:   nisplus [NOTFOUND=return] files
#networks:   nisplus [NOTFOUND=return] files
#protocols:  nisplus [NOTFOUND=return] files
#rpc:        nisplus [NOTFOUND=return] files
#ethers:     nisplus [NOTFOUND=return] files
#netmasks:   nisplus [NOTFOUND=return] files

bootparams: nisplus [NOTFOUND=return] files

ethers:     files
netmasks:   files
networks:   files
protocols:  files
rpc:        files
services:   files sss

netgroup:   files sss

publickey:  nisplus

automount:  files sss
aliases:    files nisplus

/etc/nslcd.conf包含：

# This is the configuration file for the LDAP nameservice
# switch library's nslcd daemon. It configures the mapping
# between NSS names (see /etc/nsswitch.conf) and LDAP
# information in the directory.
# See the manual page nslcd.conf(5) for more information.

# The user and group nslcd should run as.
uid nslcd
gid ldap

# The uri pointing to the LDAP server to use for name lookups.
# Multiple entries may be specified. The address that is used
# here should be resolvable without using LDAP (obviously).
#uri ldap://127.0.0.1/
#uri ldaps://127.0.0.1/
#uri ldapi://%2fvar%2frun%2fldapi_sock/
# Note: %2f encodes the '/' used as directory separator
uri ldap://<DCSERVER>

# The LDAP version to use (defaults to 3
# if supported by client library)
#ldap_version 3

# The distinguished name of the search base.
base DC=X,DC=Y

# The distinguished name to bind to the server with.
# Optional: default is to bind anonymously.
#binddn cn=proxyuser,dc=example,dc=com

提前谢谢你的帮助。

Answer 1

有一种不匹配:如果您检查sssd日志，您将使用sssd守护进程。但是，您应该在文件中配置它：

/etc/sssd/sssd.conf

不在/etc/nslcd.conf中(对pam-ldapd守护进程有好处)。

此外：

1. sssd.conf和nslcd.conf的语法有很大的不同；
2. 在/etc/nsswitch.conf中，sssd守护进程使用'sss‘键(而不是'ldap')引用。

Answer 2

我无法完全解决这个问题。

然而，对/var/log/sssd/sssd_DOMAIN.log的检查显示，SSS正在工作，但可能与未正确指定的DN有关？

(Tue Nov 25 16:21:16 2014) [sssd[be[LDI.LAN]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing!
(Tue Nov 25 16:21:16 2014) [sssd[be[LDI.LAN]]] [sdap_process_result] (0x2000): Trace: sh[0x7fc9553ddde0], connected[1], ops[0x7fc9553ed2c0], ldap[0x7fc9553d0cb0]
(Tue Nov 25 16:21:16 2014) [sssd[be[LDI.LAN]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
(Tue Nov 25 16:21:16 2014) [sssd[be[LDI.LAN]]] [sdap_get_generic_ext_done] (0x0400): Search result: Operations error(1), 000004DC: LdapErr: DSID-0C090724, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v23f0

最后，我选择使用来自Beyond Trust的开源PBIS。几分钟就开始工作了。

http://www.beyondtrust.com/Resources/OpenSourceDocumentation/