Re: Using OpenLDAP with multiple servers to authenticate

[Christian Mayrhuber <christian@osiris.at>]

m g wrote:
> 
> Hey all,
> 
> I am currently using openldap for authenticating users
> on multiple servers.  Some users are allowed access on
> all the servers and some are allowed access to only on
> a few.  My question is what is the best way to set up
> the authentication process to check which server they
> are trying to login to and if they are allowed to
> logon to that server.

There is a "host" attribute in the objectclass account, defined
in cosine.schema.
You can put as many host attributes as you want in an account
entry, to allow users access to as many hosts as you want.
You need to configure pam_ldap to require a host attribute on
authentication.

For example:
------------
A server called "fileserver" allows only logins
for users which have a host=fileserver attribute.

To achieve this put this line in /etc/pam_ldap.conf:

pam_filter host=fileserver

Unless you are using a new enough version of pam_ldap
which supports the pam_filter directive you should be done.
-- 
WfG, Chris