Learn LDAP - Linux System Authentication

#Introduction

In episode 17 you saw the concept of PAM and NSS integration at a glance. Episode 19 turns it into practice: how a Linux system really authenticates through LDAP. You'll understand the division of labor between NSS, PAM, and the LDAP client, configure nslcd, test with getent and id, handle failover and caching, and know the common failure points.

#How It Works

Linux authentication through LDAP is not a single component — it's a chain:

• NSS (Name Service Switch) — responsible for name resolution: users, groups, hosts, services. With the files and ldap entries in /etc/nsswitch.conf, getent passwd reads local files first, then LDAP.
• PAM (Pluggable Authentication Modules) — responsible for authentication itself: password validation, sessions, password changes. The PAM stack calls the LDAP module for the actual bind.
• nslcd — the daemon that mediates both: it translates NSS and PAM requests into LDAP operations, running with restricted privileges so the whole system doesn't need an LDAP account.
• SSSD — the modern alternative: a single daemon handling NSS and PAM with caching, offline operation, and multiple backend support.

The division of labor: NSS makes accounts visible, PAM makes logins work. A user account that isn't visible to NSS can't be logged into even if PAM is configured.

#Installing the Packages

On Debian and Ubuntu:

sudo apt install libnss-ldapd libpam-ldapd nslcd ldap-utils

During installation the package prompts for the LDAP URI, search base, and which NSS services (passwd, group, shadow) to use. These answers land in /etc/nslcd.conf and /etc/nsswitch.conf.

#Configuring nslcd

/etc/nslcd.conf is the heart of the integration:

uid nslcd
gid nslcd
uri ldap://ldap.example.com
base dc=example,dc=com
ldap_version 3
ssl starttls
tls_cacertfile /etc/ssl/certs/ca.crt
binddn cn=admin,dc=example,dc=com
bindpw secret
scope sub

With uid nslcd and gid nslcd, the daemon drops privileges after startup. binddn and bindpw are optional — without them, nslcd binds anonymously and relies on the directory's ACL for what it can read.

#Configuring NSS

/etc/nsswitch.conf decides which source provides which name:

passwd:         files ldap
group:          files ldap
shadow:         files ldap
hosts:          files dns
networks:       files
protocols:      db files
services:       db files
ether:          files
rpc:            files
netgroup:       nis

passwd, group, and shadow are the services to point at ldap. Order matters: files first keeps local accounts authoritative; a later failure on the LDAP side doesn't break local logins.

#Configuring PAM

On Debian, the package integration already adds the pam_ldap modules to the PAM stack. To verify, look at the common-auth stack files:

auth    [success=2 default=ignore]      pam_unix.so nullok_secure
auth    [success=1 default=ignore]      pam_ldap.so use_first_pass
auth    requisite                       pam_deny.so
auth    required                        pam_permit.so

pam_unix validates local accounts first; if the user isn't local, pam_ldap handles the LDAP authentication. use_first_pass reuses the password already collected, so the user is asked only once.

#Testing the Integration

After configuration, restart nslcd and test step by step:

sudo systemctl restart nslcd
getent passwd budi
getent group developers
id budi
ssh budi@localhost

• getent passwd budi — if the user appears with their LDAP UID, NSS works.
• getent group developers — checks group resolution.
• id budi — shows UID, GID, and group membership from LDAP.
• ssh budi@localhost — tests the full PAM stack through an SSH session.

#Failover and Caching

Production systems need more than a single LDAP URI:

• Multiple URIs — nslcd accepts several uri lines; a failing server fails over to the next.
• SSSD caching — SSSD caches credentials and attributes so logins still work during a directory outage; use cache_credentials = True in [domain] or [sssd] sections.
• Offline operation — with cached credentials, a user can log in even when the LDAP server is unreachable.
• Directory consistency — offline caches must be updated when the directory changes; the cache TTL (entry_cache_timeout) controls freshness.

[domain/example.com]
ldap_uri = ldap://ldap01.example.com,ldap://ldap02.example.com
ldap_search_base = dc=example,dc=com
cache_credentials = True

#Troubleshooting

When users can't log in:

Commands to inspect:

sudo systemctl status nslcd
journalctl -u nslcd -f
sudo -u nslcd /usr/sbin/nslcd -d

The -d flag runs nslcd in the foreground with debug output — the fastest way to see exactly what queries the daemon sends.

#Closing

In this episode 19 you integrated Linux systems with LDAP: the division of labor between NSS, PAM, nslcd, and SSSD; package installation; nslcd configuration with URI, base, and TLS; nsswitch.conf pointing passwd, group, and shadow at ldap; PAM stack verification; testing with getent, id, and SSH; failover and caching; and troubleshooting with nslcd debug mode.

Key takeaways:

• NSS makes users visible, PAM makes logins work — both must be configured.
• nslcd is the mediator — with a restricted service account, not the system's identity.
• Test layer by layer — getent first, then id, then SSH.
• Cache for resilience — SSSD keeps the system working during directory outages.

In the next episode, episode 20, we go beyond system authentication: email & address book — how Postfix and Dovecot authenticate users through LDAP, and how clients like Thunderbird and Outlook consume directory data.