8

Is there any generic solution to use a single NSS library two (or more) times?

In my case I have two LDAP servers, one local on the machine itself and one remote. I need to make NSS work with both of them (it uses the remote one if local doesn't have required entries).

Currently it was solved so that single library (PADL/nss_ldap) is build twice. In both cases before building sed is used to change all nss_ldap occurences in sources to something else. For each case a different text is used (like nss_ldap_1 and nss_ldap_2). The build result is renamed accordingly. Both binaries are stored on target system and referred to in /etc/nsswitch.conf.

Also both of those libraries use different configuration files in /etc/ (otherwise it wouldn't make any sense!). This however is done easily by just changing argument in in configure script of the library run before building.

But it doesn't "feel right". Is there any other approach?

What I could imagine is that NSS library itself could support multiple configurations so that it would work as two "single instances". But this is hard to achieve if you are not author of the library. Also it requires subsequent invocation of the library for both configurations while one might prefer to have some other library in between.

Another approach would be to write a simple forwarder that just calls some other library with different configuration. But this again requires that other library be somehow reconfigurable (if it just uses some fixed config files in /etc the forwarder will work just as the first version). And also it works only once - to have a library used three times or more the same problem returns now with forwarder itself.

Adam Badura
  • 313
  • 1
  • 2
  • 7
  • Wow, surprised that worked—don't they try to read from the same configuration file? Or did you change the config file name as well? – derobert May 19 '15 at 15:25
  • 1
    How about using [`sss`](https://jhrozek.fedorapeople.org/sssd/1.12.3/man/sssd-ldap.5.html)? – Stéphane Chazelas May 19 '15 at 15:42
  • @StéphaneChazelas I think sssd is intended to work with one authoritative LDAP system, where all the LDAP servers it talks to have the same data. OP seems to want multiple servers with different data, and some lookups to go against server1 and other lookups against server2. – derobert May 19 '15 at 15:59
  • @derobert, no, sssd should work with several independent providers. – Stéphane Chazelas May 19 '15 at 16:05
  • @derobert Yes, both libraries use different configuration file. Otherwise it wouldn't make any sense. ;) Configuration file is specified by an argument to `configure` script of `nss_ldap` that is run before building. So this didn't require our "custom modifications". – Adam Badura May 20 '15 at 06:13
  • @StéphaneChazelas: It is a bigger change. With only justification being that developers think that current solution doesn't "feel right". So as much as it is worth considering I don't expect it will be acceptable. – Adam Badura May 20 '15 at 06:18
  • 2
    On the other hand you may find that it solves a few other things like proper credential caching and more flexibility in the configuration. – Stéphane Chazelas May 20 '15 at 06:34
  • I'd also recommend you look at `sss`. Make sure you have a relatively recent version, though; I spent ages trying to work out why my configuration didn't work only to discover that the functionality I needed wasn't present in the distribution's standard build - and `sss` failed to warn me that the features were not recognised. – roaima May 24 '15 at 00:08
  • Perhaps you can make use of LDAP referrals instead? – Konrads Jun 10 '15 at 18:44

1 Answers1

4

Unfortunately, you can't do this with the NSS implementation of GNU libc. You noticed the fundamental problem, just let me present it from a different angle: the nsswitch.conf syntax does not allow for providing any additional info to the NSS service modules, thus they couldn't behave differently on repeated invocations anyway. So it isn't supported from the libc side nor from the module side. Moreover, glibc makes a point of keeping the service modules directly linkable shared objects, which excludes any linking trickery.

What you can do instead is to create a meta directory out of your two LDAP directories and use that in your NSS config. OpenLDAP supports this nicely, see the slapd-meta(5) manual page or this merge intro for example. Of course you don't need a new slapd instance for this if you can configure either of the two.

(And instead of nss-ldap use nss-ldapd if you can.)

Ferenc Wágner
  • 5,027
  • 17
  • 25