# Setting up ldap auth on Ubuntu

**URL:** <https://forum.ansible.com/t/setting-up-ldap-auth-on-ubuntu/6125>\
**Category:** Get Help\
**Tags:** ubuntu\
**Created:** [June 2, 2024, 4:59am UTC](https://forum.ansible.com/t/setting-up-ldap-auth-on-ubuntu/6125 "2024-06-02T04:59:01Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sprior](https://avatars.discourse-cdn.com/v4/letter/s/f08c70/32.png) [@sprior](https://forum.ansible.com/u/sprior)\
**Post date:** [June 2, 2024, 4:59am UTC](https://forum.ansible.com/t/setting-up-ldap-auth-on-ubuntu/6125/1 "2024-06-02T04:59:01Z")

</div>

I am trying to set up ldap authentication on Ubuntu machines using Ansible. A challenge here is that if you simply do:  
apt-get install -y libnss-ldap libpam-ldap ldap-utils nscd

You get dialog boxes with values to fill in.

I found this out of date page which got me started using debconf to set the values for those dialogs: [linux - How to do an initial setup of slapd OLC with ldapmodify - Stack Overflow](https://stackoverflow.com/questions/28937889/how-to-do-an-initial-setup-of-slapd-olc-with-ldapmodify/29277856#29277856)

And using that I was able to come up with this shell script that works (some values have been anonymized):

```auto
export DEBIAN_FRONTEND=noninteractive
sudo debconf-set-selections <<EOF
ldap-auth-config ldap-auth-config/dblogin boolean false
ldap-auth-config ldap-auth-config/dbrootlogin boolean true
ldap-auth-config ldap-auth-config/ldapns/base-dn string myvalue
ldap-auth-config ldap-auth-config/ldapns/ldap-server string myvalue
ldap-auth-config ldap-auth-config/ldapns/ldap_version select 3
ldap-auth-config ldap-auth-config/override boolean true
ldap-auth-config ldap-auth-config/rootbinddn string myvalue
ldap-auth-config ldap-auth-config/rootbindpw password myvalue
EOF
apt-get -y install libnss-ldap libpam-ldap ldap-utils nscd

```

So trying to convert that to Ansible tasks I’ve got this so far:

```auto
- name: install debconf-utils
  apt:
    name:
      - debconf-utils
    update_cache: yes
- name: do ldap auth install
  ansible.builtin.shell:
    cmd: |
      export DEBIAN_FRONTEND=noninteractive; debconf-set-selections <<EOF
      ldap-auth-config ldap-auth-config/dblogin boolean false
      ldap-auth-config ldap-auth-config/dbrootlogin boolean true
      ldap-auth-config ldap-auth-config/ldapns/base-dn string myvalue
      ldap-auth-config ldap-auth-config/ldapns/ldap-server string myvalue
      ldap-auth-config ldap-auth-config/ldapns/ldap_version select 3
      ldap-auth-config ldap-auth-config/override boolean true
      ldap-auth-config ldap-auth-config/rootbinddn string myvalue
      ldap-auth-config ldap-auth-config/rootbindpw password myvalue
      EOF; apt-get install -y libnss-ldap libpam-ldap ldap-utils nscd

```

But I’d really prefer to use the apt module for the actual install but I don’t see how to set the DEBIAN\_FRONTEND=noninteractive with the Ansible apt module.

Can someone get me the rest of the way?

---

<div class="post-metadata">

**Author:** ![sprior](https://avatars.discourse-cdn.com/v4/letter/s/f08c70/32.png) [@sprior](https://forum.ansible.com/u/sprior)\
**Post date:** [June 2, 2024, 6:00am UTC](https://forum.ansible.com/t/setting-up-ldap-auth-on-ubuntu/6125/2 "2024-06-02T06:00:14Z")

</div>

After posting this I tested and found out that the Ansible apt module appears to set DEBIAN\_FRONTEND=noninteractive out of the box so I basically had it and now it’s working. So the final tasks look like:

```auto
- name: install debconf-utils
  apt:
    pkg:
      - debconf-utils
    state: latest
    update_cache: yes
- name: set debconf values
  ansible.builtin.shell:
    cmd: |
      debconf-set-selections <<EOF
      ldap-auth-config ldap-auth-config/dblogin boolean false
      ldap-auth-config ldap-auth-config/dbrootlogin boolean true
      ldap-auth-config ldap-auth-config/ldapns/base-dn string changeme
      ldap-auth-config ldap-auth-config/ldapns/ldap-server string changeme
      ldap-auth-config ldap-auth-config/ldapns/ldap_version select 3
      ldap-auth-config ldap-auth-config/override boolean true
      ldap-auth-config ldap-auth-config/rootbinddn string changeme
      ldap-auth-config ldap-auth-config/rootbindpw password changeme
      EOF
- name: install ldap auth
  apt:
    pkg:
      - libnss-ldap
      - libpam-ldap
      - ldap-utils
      - nscd
    state: latest
    update_cache: yes
- name: configure common-session
  lineinfile:
    path: /etc/pam.d/common-session
    line: 'session required pam_mkhomedir.so skel=/etc/skel umask=077'
- name: configure common-session
  lineinfile:
    path: /etc/ldap.conf
    line: 'nss_override_attribute_value loginShell /bin/bash'
- name: Restart service nscd, in all cases
  service:
    name: nscd
    state: restarted

```

Just so nobody tries this and it doesn’t work for them, a remaining thing I’ve got to add is to update the lines in /etc/nsswitch.conf to read:  
passwd: compat ldap  
group: compat ldap  
shadow: compat ldap

---

<div class="post-metadata">

**Author:** ![chris](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/chris/32/293_2.png) [@chris](https://forum.ansible.com/u/chris)\
**Post date:** [June 2, 2024, 9:41am UTC](https://forum.ansible.com/t/setting-up-ldap-auth-on-ubuntu/6125/3 "2024-06-02T09:41:24Z")

</div>

You could potentially use the [debconf module](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/debconf_module.html) rather than the shell module for this if you want.

---

<div class="post-metadata">

**Author:** ![sprior](https://avatars.discourse-cdn.com/v4/letter/s/f08c70/32.png) [@sprior](https://forum.ansible.com/u/sprior)\
**Post date:** [June 2, 2024, 5:50pm UTC](https://forum.ansible.com/t/setting-up-ldap-auth-on-ubuntu/6125/4 "2024-06-02T17:50:47Z")

</div>

Thanks, that does look better! Despite having used Ubuntu for over a decade I didn’t know about the debconf subsystem until yesterday. I guess until you’re looking to automate installs it’s not something you’d be aware of. At the time I was posting this I was focusing on the aspect that I thought I had to set DEBIAN\_FRONTEND=noninteractive to run the apt install until I discovered that was built in. When I was Googling for automated LDAP auth install I only found obsolete info, hopefully this thread will be useful for future searches.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [July 2, 2024, 5:50pm UTC](https://forum.ansible.com/t/setting-up-ldap-auth-on-ubuntu/6125/5 "2024-07-02T17:50:58Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.