LDAP per-user overrides
I'm using openldap + nslcd to connect to a LDAP server for authentication of some users (these users would want their passwords and most of their configuration shared over many devices). I don't control the LDAP server.
However, the synchronization came after the users already had dual accounts, so names of home folders don't match (and it's not wise to move them due to possible hardcoded paths in their scripts). I'm considering a hard linked directory, but I want to know if there is a way to override home folder for a specific user, which seems cleaner and sounds like it should be a common use case.
I was unpleasantly surprised that nslcd.conf seems to accept only a single filter (per map=passwd), and map directives will simply replace the home for all users at once.
Is there a way around to elegantly "fix" single entries after LDAP lookup? My search mostly encountered answers that replace the pattern for all users, or give unhelpful answers (such as this one which simply overrides the previous filter).
What I think I need:
filter passwd (&(objectClass=inetOrgPerson)(<redacted>))
# the last part is wishful thinking, not actual syntax
map passwd homeDirectory "<redacted>" if (uid=<redacted>)
I'm new at LDAP so it's possible I don't entirely understand the order in which the transactions happen and whether it's PAM or nslcd that should do this. I realize this is not the best way to handle the situation properly, but I'd still like to know if it can be done.
pam openldap
asked 1 hour ago
orionorion
9,2331933
add a comment |
I'm using openldap + nslcd to connect to a LDAP server for authentication of some users (these users would want their passwords and most of their configuration shared over many devices). I don't control the LDAP server.
However, the synchronization came after the users already had dual accounts, so names of home folders don't match (and it's not wise to move them due to possible hardcoded paths in their scripts). I'm considering a hard linked directory, but I want to know if there is a way to override home folder for a specific user, which seems cleaner and sounds like it should be a common use case.
I was unpleasantly surprised that nslcd.conf seems to accept only a single filter (per map=passwd), and map directives will simply replace the home for all users at once.
Is there a way around to elegantly "fix" single entries after LDAP lookup? My search mostly encountered answers that replace the pattern for all users, or give unhelpful answers (such as this one which simply overrides the previous filter).
What I think I need:
filter passwd (&(objectClass=inetOrgPerson)(<redacted>))
# the last part is wishful thinking, not actual syntax
map passwd homeDirectory "<redacted>" if (uid=<redacted>)
I'm new at LDAP so it's possible I don't entirely understand the order in which the transactions happen and whether it's PAM or nslcd that should do this. I realize this is not the best way to handle the situation properly, but I'd still like to know if it can be done.
pam openldap
asked 1 hour ago
orionorion
9,2331933
add a comment |
I'm using openldap + nslcd to connect to a LDAP server for authentication of some users (these users would want their passwords and most of their configuration shared over many devices). I don't control the LDAP server.
However, the synchronization came after the users already had dual accounts, so names of home folders don't match (and it's not wise to move them due to possible hardcoded paths in their scripts). I'm considering a hard linked directory, but I want to know if there is a way to override home folder for a specific user, which seems cleaner and sounds like it should be a common use case.
I was unpleasantly surprised that nslcd.conf seems to accept only a single filter (per map=passwd), and map directives will simply replace the home for all users at once.
Is there a way around to elegantly "fix" single entries after LDAP lookup? My search mostly encountered answers that replace the pattern for all users, or give unhelpful answers (such as this one which simply overrides the previous filter).
What I think I need:
filter passwd (&(objectClass=inetOrgPerson)(<redacted>))
# the last part is wishful thinking, not actual syntax
map passwd homeDirectory "<redacted>" if (uid=<redacted>)
I'm new at LDAP so it's possible I don't entirely understand the order in which the transactions happen and whether it's PAM or nslcd that should do this. I realize this is not the best way to handle the situation properly, but I'd still like to know if it can be done.
pam openldap
asked 1 hour ago
orionorion
9,2331933
I'm using openldap + nslcd to connect to a LDAP server for authentication of some users (these users would want their passwords and most of their configuration shared over many devices). I don't control the LDAP server.
However, the synchronization came after the users already had dual accounts, so names of home folders don't match (and it's not wise to move them due to possible hardcoded paths in their scripts). I'm considering a hard linked directory, but I want to know if there is a way to override home folder for a specific user, which seems cleaner and sounds like it should be a common use case.
I was unpleasantly surprised that nslcd.conf seems to accept only a single filter (per map=passwd), and map directives will simply replace the home for all users at once.
Is there a way around to elegantly "fix" single entries after LDAP lookup? My search mostly encountered answers that replace the pattern for all users, or give unhelpful answers (such as this one which simply overrides the previous filter).
What I think I need:
filter passwd (&(objectClass=inetOrgPerson)(<redacted>))
# the last part is wishful thinking, not actual syntax
map passwd homeDirectory "<redacted>" if (uid=<redacted>)
I'm new at LDAP so it's possible I don't entirely understand the order in which the transactions happen and whether it's PAM or nslcd that should do this. I realize this is not the best way to handle the situation properly, but I'd still like to know if it can be done.
pam openldap
pam openldap
asked 1 hour ago
orionorion
9,2331933
asked 1 hour ago
orionorion
9,2331933
asked 1 hour ago
orionorion
9,2331933
asked 1 hour ago
orionorion
9,2331933
asked 1 hour ago
orionorion
9,2331933
9,2331933
add a comment |
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f508619%2fldap-per-user-overrides%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f508619%2fldap-per-user-overrides%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
