LDAP身份验证失败

我尝试设置一个LDAP目录,允许我验证Debian用户.完成LDAP服务器和PAM文件的配置后,身份验证将失败.我认为客户端没有找到ldap用户进入该目录.当我尝试使用ldap用户登录时,它表示登录错误,当我尝试使用本地用户登录时,它会向我询问密码,然后是LDAP密码.

服务器

1)我首先安装了ldap-utils libldap-2.4-2 libldap-2.4-2-dbg slapd slapd-dbg

2)在文件/etc/ldap/ldap.conf中：

BASE dc=example,dc=com    

URI ldap://192.168.1.254/

3)

dpkg-reconfigure slapd

我检查有关域的信息是否正确：正确.

4)

ldapsearch -x

它符合我之前选择的内容.

5)我为目录和用户创建.ldif文件

structure.ldif：

dn: ou=users,dc=example,dc=com
objectClass: organizationalUnit
u: users
description: users

dn: ou=computers,dc=com
objectClass: organizationalUnit
ou: computers
description: computers

dn: ou=sale,ou=users,dc=com
objectClass: organizationalUnit
ou: sale
description: sale

dn: ou=direction,dc=com
objectClass: organizationalUnit
ou: direction
description: direction

dn: cn=sale,ou=sale,dc=com
objectClass: posixGroup
gidNumber: 501
cn: sale
description: Sale group

dn: cn=direction,ou=direction,dc=com
objectClass: posixGroup
gidNumber: 502
cn: direction
description: Direction group

dn: cn=pauldupont,cn=direction,dc=newsoft,dc=ch
cn=pauldupont,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
uid: pauldupont
userPassword: pauldupont
cn: pauldupont
uidnumber: 1050
gidnumber: 501
homeDirectory: /home/profils/pauldupont
sn: pauldupont

adduseringroup.ldif：

dc: cn=sale,dc=com
changetype: modify
add: memberuid
memberuid: uid=pauldupont,dc=com

6)我将文件发送到目录：

ldapadd -x -D "cn=admin,dc=com" -W -f file.ldif

6)

ldapsearch -x

信息在那里.

客户

1)我安装了ldap-utils libldap-2.4-2 libldap-2.4-2-dbg slapd slapd-dbg libnss-ldap libpam-ldap libpam-modules libpam-cracklib nscd

2)libnss-ldap配置：服务器ip：192.168.1.254,dc = example,dc = com

3)libpam-ldap配置：不,LDAP管理员就像本地用户,不是LDAP服务器在进行查询之前要求提供信息

4)
dpkg-reconfigure libnss-ldap

信息是正确的.

5)在文件/etc/ldap/ldap.conf中

BASE dc=example,dc=com
URI ldap://192.168.1.254/

6)在文件/etc/nsswitch.conf中

passwd: compat ldap
group: compat ldap
shadow: compat ldap

7)在文件/etc/libnss-ldap.conf中

base dc=example,dc=com
uri ldap://192.168.1.254/
ldap_version 3
rootbinddn cn=admin,dc=com

8)在文件/etc/libnss-ldap.secret中

ldap password

9)在文件/etc/pam_ldap.conf中：

base dc=example,dc=com
uri ldap://192.168.1.254/
rootbinddn cn=admin,dc=com
port 389
scope sub
bind_timelimit 30
idle_timelimit 3600
pam_filter objectClass=posixAccount
pam_login_attribute uid

10)在文件/etc/pam.d/common-auth&共同账户&我在底部添加的常见会话：

auth sufficient pam_ldap.so

11)在文件/etc/pam.d/common-password中,我在底部添加了：

password sufficient pam_ldap.so use_first_pass

12)

getent passwd && getent group

仅显示本地用户和组.

13)客户端似乎联系服务器：

ldapsearch -x -H "ldap://192.168.1.254" -b "dc=example,dc=com" dn

让我回到dn条目

14)
getent passwd pauldupont

什么都没有给我,当我签入/var/log/auth.log时：

May 12 10:43:36 CLI1-DIR-DEB nscd: nss_ldap: failed to bind to LDAP server ldap:///192.168.1.254/: Invalid credentials
May 12 10:43:36 CLI1-DIR-DEB nscd: nss_ldap: reconnecting to LDAP server...
May 12 10:43:36 CLI1-DIR-DEB nscd: nss_ldap: failed to bind to LDAP server ldap:///192.168.1.254/: Invalid credentials
May 12 10:43:36 CLI1-DIR-DEB nscd: nss_ldap: reconnecting to LDAP server...
May 12 10:43:37 CLI1-DIR-DEB nscd: nss_ldap: failed to bind to LDAP server ldap:///192.168.1.254/: Invalid credentials
May 12 10:43:37 CLI1-DIR-DEB nscd: nss_ldap: could not search LDAP server - Server is unavailable

凭证似乎是错误的.我检查了上面的所有配置文件,我找不到任何错误.

有人知道问题出在哪里吗？

谢谢您的帮助.

我正在使用Debian Jessie 8.0 AMD64作为客户端和服务器

uname -a：Linux SRV1-DEB 3.16.0-4-amd64#1 SMP Debian 3.16.7-ckt9-3~deb8u1(2015-04-24)x86_64 GNU / Linux

OpenLDAP 2.4

编辑：一旦我在/etc/ldap.secret文件中添加了密码,我做了一个getent passwd,我得到了ldap用户,但我仍然无法连接.

一旦我尝试连接,我在日志文件中有这个：

May 18 09:09:53 CLI1-DIR-DEB login[904]: pam_mail(login:session): user unknown
May 18 09:09:53 CLI1-DIR-DEB login[904]: pam_loginuid(login:session): error_ log for user-name'pauldupont' does not exist
May 18 09:09:53 CLI1-DIR-DEB login[904]: pam_unix(login:session): session opened for user pauldupont by LOGIN(uid=0)
May 18 09:09:53 CLI1-DIR-DEB login[904]: pam_systemd(login:session): Failed to get user data
May 18 09:09:53 CLI1-DIR-DEB login[904]: pam_systemd(login:session): Failed to get user data
May 18 09:09:53 CLI1-DIR-DEB login[904]: User not known to the underlying authentication module