Arch Linux

schard

Forum Moderator

From: Hannover

Registered: 2016-05-06

Posts: 2,703

Website

[solved] Make GDM wait for LDAP users

I maintain a network with centralized user authentication using OpenLDAP.
After some recent updates, I run into the problem, that GDM starts before the system loaded all available users via OpenLDAP, resulting in GDM showing a "Enter User name" prompt instead of the users list.
Since there is no such thing as an OpenLDAP Client service unit the gdm.service could be systemctl-edited to wait for, I wonder what alternative, solid approach I could take to make GDM wait for the LDAP users being loaded.
Obviously I could just make GDM "sleep" for several seconds, which would be my last resort option, since I don't think that it'll be stable due to varying loading times.

Solution
I created a custom systemd service and script to wait for LDAP on the client and a sentinel user on the LDAP server.

/etc/systemd/system/ldap-loaded.service

[Unit]
Description=Wait for LDAP users to be loaded
After=network-online.target

[Service]
Type=oneshot
ExecStart=/usr/local/bin/wait-for-ldap-users
RemainAfterExit=true

/usr/local/bin/wait-for-ldap-users

#! /usr/bin/bash
USER='sentinel'

while true; do
    su -s /usr/bin/true ${USER} && exit 0
done

/etc/systemd/system/gdm.service.d/override.conf

[Unit]
After=ldap-loaded.service
Requires=ldap-loaded.service

Sentinel user on server

# sentinel, People, csh.loc
dn: uid=sentinel,ou=People,dc=mydomain,dc=com
objectClass: top
objectClass: person
objectClass: posixAccount
objectClass: shadowAccount
uid: sentinel
cn: LDAP Sentinel user to determine whether accounts are available
loginShell: /usr/bin/nologin
uidNumber: 3000
gidNumber: 3000
homeDirectory: /

Should I put my solution in the Wiki or is it considered a too special case?

Last edited by schard (2019-02-07 14:18:19)

---

Inofficial first vice president of the Rust Evangelism Strike Force