pam_ldap(8)

📦
version 0.9.13 · 5 versions
, in arch rolling, debian trixie, nixos 26.05, nixpkgs unstable, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 pam_ldap — the PAM module that hits up LDAP for auth 💖

okay so bestie, this is pam_ldap(8) from the System Manager's Manual, and it's literally the glow-up your login stack needed. sit down, grab a boba, and let's get into it 🧋✨

✨ NAME ✨

pam_ldap — a PAM module for LDAP-based authentication 🫶

🌸 SYNOPSIS 🌸

pam_ldap.so [...]

that's it. that's the whole vibe. the [...] is where all your little option besties go 👑

💅 DESCRIPTION 💅

This is a PAM module that uses an LDAP server to verify user access rights and credentials. so like, when someone tries to log in, this module is the one sliding into your LDAP directory like "hey, do we know her? is the password giving?" and then it reports back. no cap. 💖

🎀 OPTIONS 🎀

every option is a little accessory and you can stack them. here's the full collection, no skips, no cuts:

  • use_first_pass — tells the PAM module to use the first password provided in the authentication stack and not prompt the user for a password. like, we already have a password bestie, we're not asking twice 🙅‍♀️
  • try_first_pass — tells the PAM module to use the first password provided in the authentication stack, and if that fails, prompt the user for a password. so it's use_first_pass with a lil backup plan 💅
  • nullok — specifying this option allows users to log in with a blank password 😭 normally logins without a password are denied. so like... this one is a choice, and you should know it's a choice.
  • ignore_unknown_user — tells the PAM module to return PAM_IGNORE for users that are not present in the LDAP directory. this causes the PAM framework to ignore this module. stranger danger protocol activated 🦋
  • ignore_authinfo_unavail — tells the PAM module to return PAM_IGNORE if it cannot contact the LDAP server. this causes the PAM framework to ignore this module. server's not picking up the phone? okay, we move on ✨
  • no_warn — tells the PAM module that warning messages should not be propagated to the PAM application. keeping it lowkey 🤫
  • use_authtok — this causes the PAM module to use the earlier provided password when changing the password. the module will not prompt the user for a new password (it is analogous to use_first_pass). recycling era ♻️
  • debug — this option causes the PAM module to log debugging information to syslog(3). when it's not working and you need to know why, turn this on and let it yap 🔍
  • minimum_uid=UID — this option causes the PAM module to ignore the user if the user id is lower than the specified value. this can be used to bypass LDAP checks for system users (e.g. by setting it to 1000). protect the system girlies 💜

🌈 MODULE SERVICES PROVIDED 🌈

All services are provided by this module, but currently sessions changes are not implemented in the nslcd daemon. so like... it's giving everything, except that one thing. noted. 📝

🦋 FILES 🦋

  • /etc/pam.conf — the main PAM configuration file 🗂️
  • /etc/nslcd.conf — the configuration file for the nslcd daemon (see nslcd.conf(5)) 🗂️

⭐ SEE ALSO ⭐

pam.conf(5), nslcd(8), nslcd.conf(5)

go read those too, they're the supporting cast and they ate 💖

👑 AUTHOR 👑

This manual was written by Arthur de Jong <arthur@arthurdejong.org>. iconic behavior, honestly. 🫶

and that's the whole page bestie, you're now fully fluent in pam_ldap ✨

Version 0.9.13 · Feb 2025 · mwah, love u, go authenticate something 💋🎀

📦 where this page comes from