[sudo-users] sudoers in LDAP

[Eric G Ortego]

I have imported all my sudoers configs into LDAP and most everything
seems to be working the way I expected.
But shadow some how is screwing it up...
# getent shadow | grep eric
eric:x:12865::99999:7:::0
eric:x:12865::99999:7:::0

one from ldap one from /etc/shadow

nsswitch.conf
shadow: files ldap

sudo -s (with debug 1 in ldap.conf.sudo) shows me

ldap_initialize(ld,ldap://ldap.example.com)
ldap_set_option(LDAP_OPT_PROTOCOL_VERSION,0x03)
ldap_start_tls_s() ok
ldap_bind() ok
found:cn=defaults,ou=sudoers,dc=example,dc=com

However by simply removing the (identical?!)entry in /etc/shadow I end
up getting this error.

sudo -s

ldap_initialize(ld,ldap://ldap.example.com)
ldap_set_option(LDAP_OPT_PROTOCOL_VERSION,0x03)
ldap_start_tls_s(): -11: Connect error

somehow the entry returned from ldap isn't valid, because if I change
the order in nsswitch.conf to shadow: ldap files then I always get
ldap_start_tls_s(): -11: Connect error when trying to use sudo

Any ideas, suggestions, flames?
Cheers,
Eric G Ortego.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: OpenPGP digital signature
URL: </pipermail/sudo-users/attachments/20051026/8f58d09a/attachment.bin>