Not getting shadow password with nslcd 0.8.10

[Harald Hannelius <harald [at] iki.fi>]

I have several Debian 6.0 computers configured using nslcd 0.7.15 that are able 
to authenticate users in LDAP.

I now have a Debian 7.2 with nslcd 0.8.10 that I've tried to get to 
authenticate and I can't for my life figure out what's wrong.

'getent passwd' works, if logging on using ssh-keys everything is ok. 'getent 
shadow' only returns a star instead of the password-hash. Thus I am unable to 
authenticate using a password.

I am able to get the userPassword attribute from the LDAP-server using 
ldapsearch, with or without authenticating to the LDAP-directory (OpenLDAP).

This is the start of 'nslcd -dd' output from a working computer;

nslcd: version 0.7.15 starting
nslcd: DEBUG: unlink() of /var/run/nslcd/socket failed (ignored): No such file 
or directory
nslcd: DEBUG: setgroups(0,NULL) done
nslcd: DEBUG: setgid(117) done
nslcd: DEBUG: setuid(110) done
nslcd: accepting connections
nslcd: [8b4567] DEBUG: connection from pid=4533 uid=0 gid=0
nslcd: [8b4567] DEBUG: nslcd_shadow_byname(harald)

And the same section from a non-working computer;

nslcd: DEBUG: ldap_set_option(LDAP_OPT_X_TLS_REQUIRE_CERT,3)
nslcd: version 0.8.10 starting
nslcd: DEBUG: unlink() of /var/run/nslcd/socket failed (ignored): No such file 
or directory
nslcd: DEBUG: setgroups(0,NULL) done
nslcd: DEBUG: setgid(108) done
nslcd: DEBUG: setuid(105) done
nslcd: accepting connections
nslcd: [8b4567] DEBUG: connection from pid=8986 uid=0 gid=0
nslcd: DEBUG: accept() failed (ignored): Resource temporarily unavailable
nslcd: [8b4567] <shadow="harald"> DEBUG: myldap_search(base="dc=eeeeee,dc=dd", 
filter="(&(objectClass=shadowAccount)(uid=harald))")


Is there something I could check regarding the 'Resource temporarily 
unavailable'? I have tried running nslcd as root as well, to no avail.

Another difference is that the working computer generates this;

  ldap_build_search_req ATTRS: shadowFlag shadowMin shadowMax userPassword 
shadowWarning shadowInactive uid shadowExpire shadowLastChange

But the non-working one doesn't even seem to request userPassword from LDAP;

  ldap_build_search_req ATTRS: shadowExpire shadowInactive shadowFlag 
shadowWarning shadowLastChange uid shadowMin shadowMax


Please help

--
A: Top Posters!                                      |  s/y Charlotta |
Q: What is the most annoying thing on mailing lists? |    FIN-2674    |
  http://www.fe83.org/ Finn Express Purjehtijat ry   |  ============= |
Harald H Hannelius | harald (At) iki (dot) fi | GSM +358 50 594 1020
--
To unsubscribe send an email to
nss-pam-ldapd-users-unsubscribe@lists.arthurdejong.org or see
http://lists.arthurdejong.org/nss-pam-ldapd-users/