pam_filter not working

So here is the problem you want to limit your cluster to a special user group. You have everything LDAP managed and use pam_ldap for authentication. But when you edit the /etc/ldap.conf and set a pam_filter nothing happens. First of all the the syntax of pam_filter :

(|(gidNumber=1028)(gidNumber=1160))

Will not work
Literally only

pam_filter gidNumber=1028

Will work. This is the way they stupidly implemented it

      else if (!strcasecmp (k, "pam_filter"))
 {
   CHECKPOINTER (result->filter = strdup (v));
 }

where v is everything after the ' '

   while (*v != '\0' && *v != ' ' && *v != '\t')
 v++;

   *(v++) = '\0';

For those that know C

So you can give it one value max. Now you have to modify the /etc/pam.d/system-auth file. The default configuration is:

[root@lxb5477 ~]# cat /etc/pam.d/system-auth.back | grep ldap
auth        sufficient    /lib/security/$ISA/pam_ldap.so use_first_pass
account     [default=bad success=ok user_unknown=ignore] /lib/security/$ISA/pam_ldap.so
password    sufficient    /lib/security/$ISA/pam_ldap.so use_authtok
session     optional      /lib/security/$ISA/pam_ldap.so

But of course a optional is not really enough. You, of course, want that if the user doesn't fulfill your filter he should be chucked into nirvana. So change to:

[root@lxb5477 ~]# cat /etc/pam.d/system-auth | grep ldap
auth        required    /lib/security/$ISA/pam_ldap.so
account     required      /lib/security/$ISA/pam_ldap.so
password    requried    /lib/security/$ISA/pam_ldap.so use_authtok
session     required      /lib/security/$ISA/pam_ldap.so

Through this if ldap fails the login fails.

But be aware that in /etc/nsswitch.conf files is before ldap

passwd:     files ldap
shadow:     files ldap
group:      files ldap

Otherwise you have locked yourself out :)