I am preparing a Precise Pangolin image for installation on university workstations (many of them). The user and groups and their passwords (hundreds of them) are registered in an LDAP server, not in passwd/shadow. No local user accounts are used, there are only system accounts in passwd/shadow/group. The home directory comes from an nfs server, that is, /home is an NFS mount.
PROBLEM:
-----------
There is no way to log in as a user coming from LDAP. There is simply no field to type a username. There is only a guest user shown in the login screen. The only possible action is to click on LOGIN and become the guest user.
Furthermore, there is no lightdm man page. There is the file /usr/share/doc/lightdm/lightdm.conf, but it provides me no information how to fix this problem, or if the problem is caused by a configuration error.
THINGS I TRIED:
-----------------
1. So, I googled around and put allow-guest=false into /etc/lightdm/lightdm.conf. Then I restart lightdm. Result: the login screen does not come up. The screen keeps flashing between a textmode and a graphical mode. So apparently lightdm now cannot start because there is no valid user in passwd/shadow at all. It does not seem to consider LDAP users.
2. I defined some users in /etc/passwd and /etc/shadow. These are picked up by lightdm, but only if their UID is greater or equal to 1000. This despite the line in /etc/lightdm/users.conf reading: minimum-uid=500. This seems like another bug to me.
However, there is still no option to log in as an arbitrary user. That is, there is still no way to type a user name. Also, even if the LDAP users _were_ picked up (but they're not), this would not be a solution because these users will collide with the LDAP users. Or, copying all the LDAP users into passwd/shadow would defeat the purpose of having LDAP in the first place.
CONSEQUENCES:
-------------------
1. In this form, I cannot install precise pangolin on any workstation. In any organisation having more than say five linux workstations, the system management will have a central user account system. Usually this is Openldap, or Microsoft Active Directory, or Kerberos, or some of the other directory servers like the one from SuSE.
2. Therefore, any display manager or login screen that cannot cope with even Openldap is completely useless for organisations.
3. So, if it turns out that LDAP authentication is simply not implemented in lightdm, then I am going to have to skip Precise Pangolin, or revert to GDM, or possibly install another linux distro altogether, like Fedora.
4. How can Canonical ever hope to sell support contracts for university seats and the like, when sysadmins like me have to basically rebuild the distro to make it work in a managed workstation setting?
RECOMMENDATIONS:
------------------------
1. Developers at Canonical should keep the managed workstation in mind. Missing things like LDAP authentication and Kerberos are MAJOR reasons not to choose Ubuntu in an organisation. Similar problems exist with support for NFS: untested crap, for instance ubuntu NFS4 clients and a redhat server is a non-working combination and has been non-working since at least Hardy Heron. Central account management is simply non-existant in Ubuntu server. Setting up Openldap is a pain in Ubuntu server. There is not even a tested howto for setting up an Openldap or Kerberos authentication server from Canonical, and what there is, is confusing and conflicting.
2. It is quite simple to fix really; get you engineers on ubuntu workstations that are centrally managed using Openldap, and they will quickly find out what works or not. Lightdm not working with LDAP, missing HOWTO for LDAP authentication and/or Kerberos: your engineers will stumble over it inevitably. Thus they will be forced to fix it and document it.
3. I cannot believe that Ubuntu is being developed since 2004, and enterprise-critical things like setting up Openldap/Kerberos authentication are still basically non-implemented in the server version (where is the GUI??) and totally disregarded in the desktop version. It proves that workgroups and workstations are simply a non-supported category by Canonical.
Home-desktops, laptops: yes. Webservers, Virtualization servers: yes.
Authentication and fileservers for large numbers of workstations: strictly do-it-yourself. Workstations depending on NFS and LDAP: major adaptations are needed, and usually regression to the 2.2 version of GDM is needed (to get multiseat working for instance).
In the mean time, I have been able to get a login screen where you can actually type a username.
However, problems remain.
PROBLEMS:
-------------
1. Instead of `Type your username´ or `Welcome to Ubuntu´ or something like that, the login screen
now reads `Other...´. Do you think that some hundreds of students and scientist are going to understand what this `Other...´ means? It looks ridiculous, and they will ridicule the sysadmins if I would leave it like that.
How can I get rid of this stupid `Other...´ string, and configure it to say `Username:´ or something like that?
2. After login, there appears no desktop. The screen stays black. This is in KVM, with the cirrus driver. I tried both the normal ubuntu and the ubuntu 2D session. Now this could possibly be a separate bug, non-related to lightdm, so I may have to report it separately. I suspect that if you use existing user accounts, without copying over the skel files, the unity shell will not work.
Which is of course the normal situation with workstations with NFS mounted /home.