I have an old Centos Directory Server and a new 389 Directory Server. I don't want to use sssd at the moment so lets keep that suggestion off the table.I do the following my RHEL 6.4 servers:authconfig --disablesssd --disablesssdauth --enablelocauthorize --enableldap --enableldapauth --ldapserver=ldap://**ldap02** --ldapbasedn=dc=example,dc=com --enablerfc2307bis --enableforcelegacy --updateIt's broke and won't let me log in. It does show the correct info when I do an iduid=3333(myname) gid=134(mygroup) groups=134(mygroup),887(sysadmin)But if I point the authconfig at the old server and then change the ldap.conf settings afterwards it works:authconfig --disablesssd --disablesssdauth --enablelocauthorize --enableldap --enableldapauth --ldapserver=ldap://**ldap01** --ldapbasedn=dc=example,dc=com --enablerfc2307bis --enableforcelegacy --updateThen I change /etc/pam_ldap.conf and /etc/openldap/ldap.conf to point to ldap02. Bingo I can log in, but it doesn't seem to acknowledge the sysadmin group I'm in. uid=3333(myname) gid=134(mygroup) groups=134(mygroup)The old server doesn't have the sysadmin group so that tells me that the server is still looking for info on ldap01 and doing authentication from ldap02.To test that theory I changed my passwords on the old ldap01 server. Now I can only log in with the ldap02 password. But when I create a new user on ldap02 and do an id they don't show up and neither does a ldapsearch.Anyone have any idea why the server is doing lookups on one server and authentication on another. This only effects my RHEL 6 servers. My RHEL 5 servers are working perfectly.Here is the contents of pam_ldap.conf and ldap.confssl start_tlstls_checkpeer noTLS_REQCERT allowTLS_CACERTDIR /etc/openldap/cacertsURI ldap://ldap02/BASE dc=example,dc=comAnyone know what's going on here?Here is additional information if it helps:    cat /etc/sysconfig/authconfigIPADOMAINJOINED=noUSEMKHOMEDIR=noUSEPAMACCESS=noCACHECREDENTIALS=yesUSESSSDAUTH=noUSESHADOW=yesUSEWINBIND=noUSEDB=noFORCELEGACY=yesUSEFPRINTD=yesFORCESMARTCARD=noPASSWDALGORITHM=md5USELDAPAUTH=yesUSEPASSWDQC=noIPAV2NONTP=noUSELOCAUTHORIZE=yesUSECRACKLIB=yesUSEIPAV2=noUSEWINBINDAUTH=noUSESMARTCARD=noUSELDAP=yesUSENIS=noUSEKERBEROS=noUSESYSNETAUTH=noUSESSSD=noUSEHESIOD=noI though it could also be a caching issue but nscd is stopped...Well I found part of the problem finally. There was an entry in /etc/nslcd.conf for ldap01. I changed it and restarted nslcd and poof.. I can't log in again. I changed it back to the lda01 and I can log in with the ldap02's password again. This is so odd.
Directory Server doing lookups on one ldap server and authintication on another ldap server
rhel;authentication;ldap