Simon Matthews via FreeIPA-users wrote:
Your URL needs to be more specific to find users, like
cn=users,cn=accounts,dc=...
Or alternatively you could add an objectclass filter, but searching the
entire tree for users is more work than necessary.
IPA maintains a separate, synthesized tree, for compatibility with
RFC2307. This is the cn=compat entry you are seeing.
I'll also note that all users are in the group ipausers. IIRC it also
has to be a dn but I could be wrong on that.
rob
Adding "cn=users,cn=accounts" to the AuthLDAPURL worked. I am able to
authenticate specific users. However, I have not been able to get "Require
ldap-group" to work. I'll start a new thread for that.