Bug 137646

Summary:	nscd fails when using nss_ldap with SASL
Product:	Red Hat Enterprise Linux 4	Reporter:	Jack Neely <jjneely>
Component:	glibc	Assignee:	Jakub Jelinek <jakub>
Status:	CLOSED WONTFIX	QA Contact:	Brian Brock <bbrock>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	4.0	CC:	drepper, nalin
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2005-03-01 12:32:18 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jack Neely 2004-10-29 21:23:11 UTC

Description of problem:
The nscd daemon fails to function when nsswitch.conf is configured to
use ldap and /etc/ldap.conf contains the SASL options

   use_sasl on
   rootuse_sasl on

(Account information stored in LDAP via RFC 2307.)

What do I mean fails?  If I run id <username> of a valid user id will
return no such user.  If I turn off nscd id returns the proper results.  

nss_ldap/nscd does contact the LDAP server but only opens and then
closes a connection.  No query, gssapi auth, just open and close.

Version-Release number of selected component (if applicable):
nscd-2.3.3-53
nss_ldap-220-3

Comment 1 Jakub Jelinek 2004-11-01 09:03:27 UTC

First of all, nscd-2.3.3-53 is old, try something newer (e.g. 2.3.3-74
in rawhide).
nscd has debug mode if you start it with /usr/sbin/nscd -d > /tmp/nscd.log

Comment 2 Jack Neely 2004-11-02 13:29:50 UTC

After more research I have discovered the source of the problem.

With user information stored in LDAP accessed via the nss_ldap module
there are two ways to use SASL authentication.  (Kerberos in this
case.)  With the nscd daemon turned off, there is no caching but each
user uses his own credintials to authenticate to the LDAP server. 
With nscd turned on root is doing the authentication and retrieval
from the LDAP server wich requires a keytab and a system service ticket.

I would like to be able to use the users' kerberos tickets and still
have the caching nscd provides.

Comment 3 Jakub Jelinek 2005-03-01 12:32:18 UTC

So just set up a system service ticket or stop caching.