LDAP helps us to provide centralized storage of usernames and passwords. After setting up a working LDAP server, we will need to install libraries and configure the client for connecting to it on an Ubuntu system.

As a part of our Server Management Services, we help our Customers with software installations regularly.

Let us today discuss the steps to configure LDAP Client on Ubuntu.

LDAP and its uses

LDAP (Lightweight Directory Access Protocol) is a set of protocols for accessing directory services.

A directory service stores and provides access to information that must either be shared between applications or is highly distributed.

Directory services play an important role in developing intranet and Internet applications by helping us to share information about users, systems, networks, applications, and services throughout the network.

For instance, it helps us to offer centralized storage of usernames and passwords. This allows various applications (or services) to connect to the LDAP server to validate users.

Install and Configure LDAP Client on Ubuntu

Initially, if we do not have an active DNS server in our network, we need to add an LDAP server address to /etc/hosts file.

$ echo “IP_address ldap.example.com” | sudo tee -a /etc/hosts

Install LDAP client utilities on an Ubuntu system

Now let us proceed to install the LDAP client utilities. Like in all other installation, we need to update the system prior to the installation

$ sudo apt-get update

$ sudo apt -y install libnss-ldap libpam-ldap ldap-utils

During the installation, the package installer will ask us a variety of questions. Enter the values according to the environment.

1. Set LDAP URI – On the first screen, enter the LDAP server details. Enter the LDAP server’s IP address or hostname.
2. Set a Distinguished name of the search base – Here enter the DN (Domain Name) of the LDAP search base
3. Choose the LDAP version to use.
   
4. Select Yes to make local root Database admin
5. Answer No for Does the LDAP database requires login?
6. Set LDAP account for root, something like cn=admin,cd=example,cn=com
7. Provide LDAP root account Password

Configure authentication:

The installer does most of the configurations based on our inputs given in the previous section. But, there are still some changes required for LDAP authentication to work.

After the installation, edit /etc/nsswitch.conf and add LDAP authentication to passwd and group lines.

passwd: compat systemd ldap
group:    compat systemd ldap
shadow: compat ldap

Modify the file /etc/pam.d/common-password. Remove use_authtok on line 26 to look like below.

password [success=1 user_unknown=ignore default=die] pam_ldap.so try_first_pass

Enable creation of home directory on the first login by adding the following line to the end of file /etc/pam.d/common-session

session optional pam_mkhomedir.so skel=/etc/skel umask=077

Restart the nscd service.

$ sudo service nscd restart

Test by switching to a user account on LDAP

root@server1:~# su - bob
Creating directory '/home/bob'.
bob@server1:~$ id
uid=10000(bob) gid=10000(sysadmins) groups=10000(sysadmins)

Use the getent command to get the LDAP entries from the LDAP server.

$ getent passwd ldapuser

ldapuser:x:9999:100:Test LdapUser:/home/ldapuser:/bin/bash

Further, to verify the LDAP, log in using the LDAP user “ldapuser” on the client machine.

[Need any further assistance to configure LDAP client on Ubuntu – We’re available 24*7]

Conclusion

In short, LDAP is a widely used protocol for querying and modifying a directory service. Today, we saw how our Support Engineers configure LDAP client on Ubuntu