Bug 137646 - nscd fails when using nss_ldap with SASL
nscd fails when using nss_ldap with SASL
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: glibc (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Jakub Jelinek
Brian Brock
Depends On:
  Show dependency treegraph
Reported: 2004-10-29 17:23 EDT by Jack Neely
Modified: 2007-11-30 17:07 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2005-03-01 07:32:18 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Jack Neely 2004-10-29 17:23:11 EDT
Description of problem:
The nscd daemon fails to function when nsswitch.conf is configured to
use ldap and /etc/ldap.conf contains the SASL options

   use_sasl on
   rootuse_sasl on

(Account information stored in LDAP via RFC 2307.)

What do I mean fails?  If I run id <username> of a valid user id will
return no such user.  If I turn off nscd id returns the proper results.  

nss_ldap/nscd does contact the LDAP server but only opens and then
closes a connection.  No query, gssapi auth, just open and close.

Version-Release number of selected component (if applicable):
Comment 1 Jakub Jelinek 2004-11-01 04:03:27 EST
First of all, nscd-2.3.3-53 is old, try something newer (e.g. 2.3.3-74
in rawhide).
nscd has debug mode if you start it with /usr/sbin/nscd -d > /tmp/nscd.log
Comment 2 Jack Neely 2004-11-02 08:29:50 EST
After more research I have discovered the source of the problem.

With user information stored in LDAP accessed via the nss_ldap module
there are two ways to use SASL authentication.  (Kerberos in this
case.)  With the nscd daemon turned off, there is no caching but each
user uses his own credintials to authenticate to the LDAP server. 
With nscd turned on root is doing the authentication and retrieval
from the LDAP server wich requires a keytab and a system service ticket.

I would like to be able to use the users' kerberos tickets and still
have the caching nscd provides.
Comment 3 Jakub Jelinek 2005-03-01 07:32:18 EST
So just set up a system service ticket or stop caching.

Note You need to log in before you can comment on or make changes to this bug.