gandc/lldap
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

example_configs: Update PAM integration

Browse Source 
* Add more information for PAM integration:

* Add info that custom attributes only work on nightly
* Add sample lldap-cli command to set attribute

* Modify nslcd to use unix-uid/gid directly as it is now supported

* Add readme for PAM integration, removing the need for is-unix-user/group.
This commit is contained in:
Roman
2024-09-16 18:19:03 -04:00
committed by GitHub
parent 10a820f2a2
commit a2ba71ac19
2 changed files with 22 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
example_configs/pam/nslcd.conf
View File

@@ -16,8 +16,8 @@ base dc=example,dc=net
#ldap_version 3
# The DN to bind with for normal lookups.
#binddn cn=...,ou=people,dc=example,dc=com
#bindpw ...
binddn cn=...,ou=people,dc=example,dc=com
bindpw ...
# The DN used for password modifications by root.
#rootpwmoddn cn=admin,dc=example,dc=com
@@ -34,17 +34,17 @@ reconnect_invalidate passwd group
nss_initgroups_ignoreusers ALLLOCAL
# Do you have users/groups that aren't for linux? These filters determine which user/group objects are used.
filter passwd (&(objectClass=posixAccount)(is-unix-user=1))
filter group (&(objectClass=groupOfUniqueNames)(is-unix-group=1))
filter passwd (&(objectClass=posixAccount)(unix-uid=*))
filter group (&(objectClass=groupOfUniqueNames)(unix-gid=*))
# This check is done AFTER authentication, in the pam "account" stage.
# Regardless of if they used a LDAP password, or an SSH key, if they're an LDAP user, they have to pass this check.
pam_authz_search (&(objectClass=posixAccount)(is-unix-user=1)(unix-username=$username)(memberOf=cn=YOUR_LOGIN_GROUP_FOR_THIS_MACHINE,ou=groups,dc=example,dc=com))
pam_authz_search (&(objectClass=posixAccount)(unix-uid=*)(unix-username=$username)(memberOf=cn=YOUR_LOGIN_GROUP_FOR_THIS_MACHINE,ou=groups,dc=example,dc=com))
map passwd uid unix-username
map passwd uidNumber unix-uid
map passwd gidNumber unix-uid
map passwd gidNumber unix-gid
map passwd gecos unix-username
map passwd homeDirectory "/home/${unix-username}"
map passwd loginShell unix-shell