Unity, PowerStore: LDAP-enabled NAS server cannot retrieve expected information from LDAP server due to attribute case-sensitivity
Summary: Active Directory (AD) based LDAP is case-insensitive by default, while other implementations may not be
Symptoms
While deploying NAS servers that use LDAP, the LDAP server is not returning the expected results when the NAS server queries the LDAP server. For example, querying groups with svc_nas or svc_nas_tools might return the group name with an empty list of members.
Cause
AD-based LDAP is case-insensitive by default, while other implementations may be case-sensitive.
FreeIPA is a common AD alternative which is case-sensitive by default, but other implementations may be designed this way as well. Some AD-based LDAP implementations may have been reconfigured after the initial setup to be case-sensitive. The Unity/PowerStore NAS implementation will always pass queries to the server using the case defined in ldap.conf (or LDAP schema), but case mismatches between the NAS server configuration and the LDAP server configuration will only cause problems when the LDAP server is configured to process queries in a case-sensitive manner.
Resolution
Review the documentation for the LDAP implementation and confirm if the LDAP server is configured to be case-sensitive.
The ldap.conf file (or LDAP schema) should be reviewed to confirm if the attributes have a case that matches what is defined in the LDAP server.
For example, this line:
nss_map_attribute memberUid member
If changed to this, could cause LDAP lookups to not return the expected results:
nss_map_attribute memberuid member