[gentoo-user] LDAP: Slapd fails asking itself while startup

[gentoo-user] LDAP: Slapd fails asking itself while startup

[Bertram Scharpf]

Hi,

I just set up LDAP authentication and it works fine.
However, when running the init script there comes up an
error that clutters up my syslog with a lot of useless error
messages.

  @(#) $OpenLDAP: slapd 2.3.38 (Oct 18 2007 22:12:26) $ 	root@myhost:/var/tmp/portage/net-nds/openldap-2.3.38/work/openldap-2.3.38/servers/slapd
  nss_ldap: failed to bind to LDAP server ldap://127.0.0.1: Can't contact LDAP server
  nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server
  nss_ldap: failed to bind to LDAP server ldapi://%2fvar%2frun%2fldapi_sock/: Can't contact LDAP server
  ...
  nss_ldap: could not search LDAP server - Server is unavailable
  WARNING: No dynamic config support for database ldbm.
  slapd starting

I found out that the Gentoo init script activates the
options "-u ldap -g ldap". Without them, the error messages
do not appear. Therefore I suppose the slapd daemon tries to
obtain passwd/shadow information for ldap via nss_ldap. At
least when I say "compat" in nsswitch.conf, the error
message doesn't appear as well.

The thing I really wonder about is that the lines in
nsswitch.conf say

  passwd:    files ldap
  shadow:    files ldap
  group:     files ldap

The files should be searched first. The "ldap" information
is present in all three of them. I even tried to chown the
shadow file to ldap but this didn't save me from
encountering the weird messages either.

Could someone enlighten me what is going on here, please?

Thanks in advance,

Bertram Scharpf


-- 
Bertram Scharpf
Stuttgart, Deutschland/Germany
http://www.bertram-scharpf.de
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] LDAP: Slapd fails asking itself while startup

[Bertram Scharpf]

Hi,

Am Freitag, 19. Okt 2007, 21:09:59 +0200 schrieb Bertram Scharpf:
> I just set up LDAP authentication and it works fine.
> However, when running the init script there comes up an
> error that clutters up my syslog with a lot of useless error
> messages.
> 
>   @(#) $OpenLDAP: slapd 2.3.38 (Oct 18 2007 22:12:26) $ 	root@myhost:/var/tmp/portage/net-nds/openldap-2.3.38/work/openldap-2.3.38/servers/slapd
>   nss_ldap: failed to bind to LDAP server ldap://127.0.0.1: Can't contact LDAP server
>   nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server
>   nss_ldap: failed to bind to LDAP server ldapi://%2fvar%2frun%2fldapi_sock/: Can't contact LDAP server
>   ...
>   nss_ldap: could not search LDAP server - Server is unavailable
>   WARNING: No dynamic config support for database ldbm.
>   slapd starting
> 
> I found out that the Gentoo init script activates the
> options "-u ldap -g ldap". Without them, the error messages
> do not appear. Therefore I suppose the slapd daemon tries to
> obtain passwd/shadow information for ldap via nss_ldap. At
> least when I say "compat" in nsswitch.conf, the error
> message doesn't appear as well.
> 
> The thing I really wonder about is that the lines in
> nsswitch.conf say
> 
>   passwd:    files ldap
>   shadow:    files ldap
>   group:     files ldap
> 
> The files should be searched first. The "ldap" information
> is present in all three of them. I even tried to chown the
> shadow file to ldap but this didn't save me from
> encountering the weird messages either.

I detected I have a machine where this didn't happen. Then I
upgraded from glibc-2.5-r4 to glibc-2.6.1 ...

Could this be a real bug in glibc? Does anybody experience
the same behaviour?

Thanks in advance,

Bertram


-- 
Bertram Scharpf
Stuttgart, Deutschland/Germany
http://www.bertram-scharpf.de
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] LDAP: Slapd fails asking itself while startup [solved]

[Bertram Scharpf]

Am Montag, 22. Okt 2007, 06:20:56 +0200 schrieb Bertram Scharpf:
> Hi,
> 
> Am Freitag, 19. Okt 2007, 21:09:59 +0200 schrieb Bertram Scharpf:
> >   @(#) $OpenLDAP: slapd 2.3.38 (Oct 18 2007 22:12:26) $ 	root@myhost:/var/tmp/portage/net-nds/openldap-2.3.38/work/openldap-2.3.38/servers/slapd
> >   nss_ldap: failed to bind to LDAP server ldap://127.0.0.1: Can't contact LDAP server
> >   nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server
> >   nss_ldap: failed to bind to LDAP server ldapi://%2fvar%2frun%2fldapi_sock/: Can't contact LDAP server
> >   ...
> >   nss_ldap: could not search LDAP server - Server is unavailable
> > 
> > I found out that the Gentoo init script activates the
> > options "-u ldap -g ldap".
> 
> I detected I have a machine where this didn't happen. Then I
> upgraded from glibc-2.5-r4 to glibc-2.6.1 ...
> 
> Could this be a real bug in glibc? Does anybody experience
> the same behaviour?

The developer list gave me the answer. Glibc checks for
group memberships of user ldap. A possible (temporary)
solution is to say in /etc/ldap.conf:

  nss_initgroups_ignoreusers root,ldap

Bertram


-- 
Bertram Scharpf
Stuttgart, Deutschland/Germany
http://www.bertram-scharpf.de
-- 
gentoo-user@gentoo.org mailing list