Red Hat Bugzilla – Bug 84376
glibc's nss_compat.so library fails to implement ldap functions
Last modified: 2016-11-24 10:02:55 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3a) Gecko/20021207
Description of problem:
It is impossible to use "compat" in nsswitch.conf to restrict access to a
machine using LDAP as its naming service. The nss_compat.so library in Linux is
tied strictly to NIS/NIS+.
I realize that, since this will need hooks into openldap to work properly,
fixing this either requires you to split nss_compat into a separate package
(probably a good idea), or make glibc depend on openldap (probably not such a
good idea), but either way, it's something that really should be implemented.
I'm willing to heavily test the code, but I don't have enough knowledge of the
ldap internals to write it myself.
I also sent a message to firstname.lastname@example.org, but I have gotten no response about
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Set up a Linux machine as an LDAP client
2. Make sure the machine is NOT bound to a NIS/NIS+ domain
2. Set "passwd: compat" and "passwd_compat: ldap" in nsswitch.conf
3. add "+username" at the end of /etc/passwd for some user
4. try to log in as the user
Actual Results: nss_compat tries to check for user's validity using NIS, not
LDAP, so the login fails.
Expected Results: nss_compat needs to make calls to the LDAP library instead
I've checked the latest glibc source from GNU (2.3.1), and there has still not
been work done in this area.
*** Bug 84378 has been marked as a duplicate of this bug. ***
Can you please expand on why you need to use nss_compat for ldap?
Why doesn't passwd: ldap work for you?
passwd: ldap works fine, but doesn't allow me to restrict access in the way that
I would like. For example, if my development domain has a webserver (or
fileserver, nameserver, etc.) in it, and I only want administrators to have
login access, my current way to do this is with compat mode, an admin netgroup,
and a "+@admin" line at the bottom of the password file. I think this is pretty
standard in the Solaris world. This works fine with Linux under NIS or NIS+, so
I was surprised to find that it doesn't work for LDAP. It essentially means
that I have to change to an "everybody or nobody" policy for LDAP-based user logins.
Unless you know of another comparable way to control this, I'd consider it a
This is no bug. nss_compat has one purpose only: to work with NIS and the old
format used in the passwd file. There will never ever be a change as demanded
here in nss_compat. But the nss module interface is documented. Feel free to
write zour own nss module and use it.