I'm trying to enable LDAP authentication on Ubuntu using the guides below: https://computingforgeeks.com/how-to-configure-ubuntu-18-04-ubuntu-16-04-lts-as-ldap-client/
https://help.ubuntu.com/community/LDAPClientAuthentication
https://www.youtube.com/watch?v=l0e8rG0mku8
Nothing seems to work so far. ldapsearch works, but I can't login or test with "id" and "getent" commands. The only difference from the manuals is that I don't have ldap admin account and do not specify it, but I don't think this should break the rest. Appreciate any suggestions on how to troubleshoot PAM and ldap client
cat /etc/nsswitch.conf
passwd: files ldap
group: files ldap
shadow: files ldap
gshadow: files
. . .
cat /etc/pam.d/common-session
session [default=1] pam_permit.so
session requisite pam_deny.so
session required pam_mkhomedir.so umask=0022 skel=/etc/skel/
session required pam_permit.so
session optional pam_umask.so
session required pam_unix.so
session optional pam_ldap.so
session optional pam_systemd.so
sudo nano /etc/pam.d/common-auth
auth required pam_group.so use_first_pass
auth [success=2 default=ignore] pam_unix.so nullok_secure try_first_pass
auth [success=1 default=ignore] pam_ldap.so use_first_pass
auth requisite pam_deny.so
auth required pam_permit.so
auth optional pam_cap.so
sudo nano /etc/pam.d/common-password
password requisite pam_pwquality.so retry=3
password [success=2 default=ignore] pam_unix.so obscure use_authtok try_first_pass sha$
password [success=1 user_unknown=ignore default=die] pam_ldap.so use_authtok try_first_$
password requisite pam_deny.so
password required pam_permit.so
password optional pam_gnome_keyring.so
$ ldapsearch -x -H ldap://ldap.server.com -b ou=employee,o=test,c=an -LLL "(alias=test_username)" cn
dn: cn=Test User 5142,ou=employee,o=slb,c=an
cn: Test User
cn: Test User 5142
$su - test_username
No passwd entry for user 'test_username'
$ getent passwd test_username
$
