我正在设置一个新的 CentOS 7 服务器，并且需要设置 LDAP 身份验证，即已经存在一个对用户进行身份验证的服务器，我们将其用于其他 GNU/Linux 服务器。
例如，在 Windows 中，我可以使用 查询 DC 的主机名和 IP nltest /dclist:X.Y。它将返回一个 DC 服务器列表，我可以确认这些服务器是正确的。
ldapsearch当我在 CentOS 7 服务器上测试与这些 DC 服务器的连接时，它正常工作：
ldapsearch -H ldap://<DCSERVER> -D <user>@X.Y -w
输出是一长串信息，包括 DN 信息。
但是，使用时getent passwd，没有输出，并且我在 /var/log/messages 中看到错误：
Nov 24 16:09:37 XXXXXXXX nslcd[22440]: [16e9e8] <passwd(all)> ldap_result() failed: Operations error: 000004DC: LdapErr: DSID-0C09072B, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580
getent password在其他 CentOS 6 服务器上运行良好，但他们正在使用 BeyondTrust，我想迁移出去，而且在安装时我不是管理员。
相关配置文件：
/etc/openldap/ldap.conf包含：
#
# LDAP Defaults
#
# See ldap.conf(5) for details
# This file should be world readable but not world writable.
#BASE dc=example,dc=com
#URI ldap://ldap.example.com ldap://ldap-master.example.com:666
#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
TLS_CACERTDIR /etc/pki/tls/certs
# Turning this off breaks GSSAPI used with krb5 when rdns = false
SASL_NOCANON on
URI ldap://<DCSERVER>
BASE DC=X,DC=Y
/etc/nsswitch.conf包含：
#
# /etc/nsswitch.conf
#
# An example Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
#
# The entry '[NOTFOUND=return]' means that the search for an
# entry should stop if the search in the previous entry turned
# up nothing. Note that if the search failed due to some other reason
# (like no NIS server responding) then the search continues with the
# next entry.
#
# Valid entries include:
#
# nisplus Use NIS+ (NIS version 3)
# nis Use NIS (NIS version 2), also called YP
# dns Use DNS (Domain Name Service)
# files Use the local files
# db Use the local database (.db) files
# compat Use NIS on compat mode
# hesiod Use Hesiod for user lookups
# [NOTFOUND=return] Stop searching if not found so far
#
# To use db, put the "db" in front of "files" for entries you want to be
# looked up first in the databases
#
# Example:
#passwd: db files nisplus nis
#shadow: db files nisplus nis
#group: db files nisplus nis
passwd: files ldap
shadow: files ldap
group: files ldap
#initgroups: files
#hosts: db files nisplus nis dns
hosts: files dns
# Example - obey only what nisplus tells us...
#services: nisplus [NOTFOUND=return] files
#networks: nisplus [NOTFOUND=return] files
#protocols: nisplus [NOTFOUND=return] files
#rpc: nisplus [NOTFOUND=return] files
#ethers: nisplus [NOTFOUND=return] files
#netmasks: nisplus [NOTFOUND=return] files
bootparams: nisplus [NOTFOUND=return] files
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files sss
netgroup: files sss
publickey: nisplus
automount: files sss
aliases: files nisplus
/etc/nslcd.conf包含：
# This is the configuration file for the LDAP nameservice
# switch library's nslcd daemon. It configures the mapping
# between NSS names (see /etc/nsswitch.conf) and LDAP
# information in the directory.
# See the manual page nslcd.conf(5) for more information.
# The user and group nslcd should run as.
uid nslcd
gid ldap
# The uri pointing to the LDAP server to use for name lookups.
# Multiple entries may be specified. The address that is used
# here should be resolvable without using LDAP (obviously).
#uri ldap://127.0.0.1/
#uri ldaps://127.0.0.1/
#uri ldapi://%2fvar%2frun%2fldapi_sock/
# Note: %2f encodes the '/' used as directory separator
uri ldap://<DCSERVER>
# The LDAP version to use (defaults to 3
# if supported by client library)
#ldap_version 3
# The distinguished name of the search base.
base DC=X,DC=Y
# The distinguished name to bind to the server with.
# Optional: default is to bind anonymously.
#binddn cn=proxyuser,dc=example,dc=com
在此先感谢您的帮助。
答案1
存在不匹配的情况：如果您检查 sssd 日志，则您正在使用 sssd 守护程序。但您应该在文件中对其进行配置：
/etc/sssd/sssd.conf
不在 /etc/nslcd.conf 中（对于 pam-ldapd 守护进程来说很好）。
而且：
- sssd.conf 和 nslcd.conf 的语法非常不同；
- 在 /etc/nsswitch.conf 中，sssd 守护进程通过“sss”键（而不是“ldap”）引用。
答案2
我无法彻底解决这个问题。
然而，检查/var/log/sssd/sssd_DOMAIN.log显示 SSS 正在运行，但可能是由于 DN 指定不当导致的问题？
(Tue Nov 25 16:21:16 2014) [sssd[be[LDI.LAN]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing!
(Tue Nov 25 16:21:16 2014) [sssd[be[LDI.LAN]]] [sdap_process_result] (0x2000): Trace: sh[0x7fc9553ddde0], connected[1], ops[0x7fc9553ed2c0], ldap[0x7fc9553d0cb0]
(Tue Nov 25 16:21:16 2014) [sssd[be[LDI.LAN]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
(Tue Nov 25 16:21:16 2014) [sssd[be[LDI.LAN]]] [sdap_get_generic_ext_done] (0x0400): Search result: Operations error(1), 000004DC: LdapErr: DSID-0C090724, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v23f0
最后，我选择使用 Beyond Trust 的开源 PBIS。几分钟就搞定了。
http://www.beyondtrust.com/Resources/OpenSourceDocumentation/