nssldap

nssldap, also known as nss-ldap or libnss-ldap, is a client-side library that provides LDAP-backed Name Service Switch (NSS) and PAM services. It allows a Unix-like system to obtain user and group information, as well as perform authentication, from an LDAP directory such as OpenLDAP or 389 Directory Server.

The library enables standard NSS calls (for example getpwnam, getpwuid, getgrnam, getgrgid) to be answered from entries stored in LDAP. It also supports PAM-based authentication, letting users log in using credentials validated against the LDAP directory. Typical deployments use TLS or StartTLS to secure connections and may support multiple LDAP servers, search bases, and filtering to limit data exposure.

Configuration usually involves a dedicated LDAP client configuration file (commonly /etc/ldap.conf or /etc/libnss-ldap.conf) that specifies the LDAP server URL(s), the base DN, bind credentials, and encryption settings. System configuration files such as /etc/nsswitch.conf are updated to include ldap for passwd, shadow, and group lookups, and PAM stacks are adjusted to use the LDAP-based modules for authentication and account management if not using an alternative mechanism.

Security considerations include enforcing encrypted connections (LDAPS or StartTLS), validating server certificates, and restricting LDAP search scopes to minimize data exposure. Proper access controls on the LDAP directory and careful tuning of search bases and filters are essential.

In many modern environments, nss-ldap has been supplemented or replaced by alternative solutions such as SSSD or integrated directory services. It remains used in legacy setups and in distributions that continue to provide the libnss-ldap and pam-ldap packages.