I have a fresh install of Debian 12.0 that I wanted to authenticate with LDAP following instructions at: https://wiki.debian.org/LDAP/NSS. However, it is not working.

The LDAP server is in a different server than the client and I can assert it is working correctly as it is used to authenticate other servers that have older installations of Debian. Moreover, since commands like getent passwd work as expected, the “fresh Debian” is indeed communicating with the “LDAP server”.

I would think that the main symptom is that getent shadow only returns the correct listing of accounts that a regular user would see (i.e. without the password hashes). The output only consists of lines that look like:

user:*::14:400:7:1::

The above is true even if I run getent shadow as root. Thus, the system never has access to the passwords to attempt authentication.

If I run in debug mode (nslcd -d) the only unexpected lines are:

nslcd: DEBUG: CFG: # tls_crlcheck ERROR: Can’t contact LDAP server

and

nslcd: DEBUG: accept() failed (ignored): Resource temporarily unavailable

both messages that are mentioned as unimportant in forums I checked. I tried both with and without having LDAP’s admin password at /etc/libnss-ldap.secret

Note that I purposely tried to install a NSS-LDAP only setup without involving PAM with LDAP.

Thanks!