[nssldap] boot failure (using local files) if ldap unavailable

[Jack Bates <ms419 [at] freezone.co.uk>]

We have at least two systems running libnss-ldap, one Debian lenny and
one Ubuntu feisty. Both exhibit this same problem.

Both systems boot fine without libnss-ldap. My goal is for each system
to continue working with libnss-ldap: local passwd and group files
should override values from our LDAP directory. However I would like
users without local accounts to be able to login with their LDAP
account.

To this end, I changed the passwd and group lines in nsswitch.conf
(see entire file attached):

passwd:         compat ldap
group:          compat ldap

This works great when our LDAP server is available, but if it's not, I
still want users with local accounts to be able to login. Instead, if I
boot the system and our LDAP server is unavailable, no logins are
possible. Not even root is able to login. In this case, I need to reboot
the system in single user mode and remove ldap from nsswitch.conf before
anyone can login.

This is particularly a problem on the system actually running our LDAP
server, since our LDAP server is obviously never available when it
boots. In this case as well, I must boot in single user mode, remove
ldap from nsswitch.conf, finish booting, and finally return ldap to
nsswitch.conf. Once done, users can happily login with their LDAP
accounts.

I have also tried changing the passwd and group lines in nsswitch.conf:

passwd:         compat ldap [NOTFOUND=return]
group:          compat ldap [NOTFOUND=return]

This case behaves the same when our LDAP server is unavailalbe. When our
LDAP server is available, users with local accounts can login, but users
with LDAP accounts can't.

I've not yet installed nscd or either system.

Thanks for maintaining libnss-ldap, Jack

# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd:         compat ldap
group:          compat ldap
shadow:         compat

hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis