Centralized Authentication and Home Directories with UCS, LDAP, and NFS

In Part 2, we built the LTSP server for PXE boot thin clients on Ubuntu 24.04. The server can now provide a basic PXE boot environment for client machines.

In this third part, we will connect the LTSP environment to Univention Corporate Server, also called UCS.

UCS will provide two important services for the thin client setup:

1. LDAP authentication, so users can log in with centralized accounts
2. NFS home directories, so users can access the same files and settings from any thin client

This follows the original lab design, where the thin clients boot through PXE, authenticate against an existing UCS LDAP directory, and mount /home from the same UCS server over NFS.

Why UCS Is Used in This Design

Univention Corporate Server is useful in this setup because it can act as the central identity and file service platform for the thin client environment.

Instead of managing users locally on the LTSP server, user accounts are created and managed in UCS. The LTSP server checks UCS when a user logs in. The user’s home directory is also stored on UCS and mounted through NFS.

The simplified flow looks like this:

Thin Client
     |
     | PXE boot
     v
LTSP Server on Ubuntu 24.04
     |
     | User lookup and login
     v
UCS LDAP Directory
     |
     | User home directory
     v
UCS NFS Share
     |
     v
XFCE desktop or kiosk session

UCS supports centralized directory management through LDAP, and its manual includes domain services, LDAP directory, user management, and UCS web interface modules as part of the platform.

For file storage, UCS supports central management of directory shares. UCS shares can be provided through CIFS for Windows and Linux clients, or through NFS for Linux and Unix clients. UCS-managed NFS shares can be mounted by clients through NFSv3 and NFSv4.

What Is LDAP?

LDAP means Lightweight Directory Access Protocol.

In this design, LDAP is used so the LTSP server can read user account information from UCS.

LDAP answers questions like:

Does this user exist?
What is the user's UID?
What is the user's GID?
What groups does the user belong to?
What is the user's home directory?
What shell should the user use?
Is the password correct?

Linux needs this information when a user logs in.

For example, a UCS user may have account data like this:

Username:        student01
UID number:      20001
GID number:      5001
Home directory:  /home/student01
Login shell:     /bin/bash

The username is what the person types. The UID and GID are what Linux uses for file ownership and permissions.

What Is NFS?

NFS means Network File System.

NFS allows one server to share a directory over the network. Other Linux systems can mount that shared directory and use it like a local folder.

In this design, UCS shares /home through NFS.

That means user home directories are stored on UCS, not separately on every thin client.

Example:

UCS server export:  ucs01.pinoylinux.intranet:/home
LTSP mount point:   /home
User folder:        /home/student01

When student01 logs in from a thin client, the user sees:

/home/student01

But the actual files are stored on the UCS server.

This is important because /home contains user files and user settings, such as:

Documents
Downloads
Desktop files
XFCE settings
Browser profile data
Application settings
.xsession file

Without NFS, users may lose settings when they move from one thin client to another. With NFS, the user gets the same home directory from any client.

Why LDAP and NFS Work Together

LDAP provides the user identity. NFS provides the user files.

LDAP tells Linux:

student01 has UID 20001 and home directory /home/student01

NFS provides:

The actual /home/student01 folder from UCS

The most important rule is this:

The UID and GID in LDAP must match the owner of the home directory on NFS.

If the UID and GID do not match, the user may log in but fail to write files. The user may also see permission errors, broken desktop settings, or login problems.

Target Setup

This article uses the following sample values:

UCS server hostname:     ucs01.pinoylinux.intranet
UCS server IP address:   192.168.100.75
LDAP base DN:            dc=pinoylinux,dc=intranet
LDAP user container:     cn=users,dc=pinoylinux,dc=intranet
LTSP server hostname:    ltsp01.pinoylinux.intranet
LTSP server OS:          Ubuntu 24.04 LTS
NFS export from UCS:     192.168.100.75:/home
LTSP mount path:         /home

Replace these values with your own domain, hostname, IP address, and user structure.

Do not publish real bind passwords in the article.

Step 1: Install UCS

Install UCS on a server or virtual machine that will act as the central identity and file server.

During installation, choose the correct language, keyboard, storage, network settings, and domain settings. The UCS installer is interactive and asks for the system settings through a graphical interface.

For this design, UCS should have a static IP address.

Example:

Hostname:    ucs01
Domain:      pinoylinux.intranet
IP address:  192.168.100.75
Role:        Primary Directory Node

Illustration 1: UCS installation starts with language, keyboard, storage, network, and domain setup.


Illustration 2: UCS is configured with a static IP address and domain name for centralized user management.

Step 2: Log In to the UCS Web Interface

After installation, open the UCS web interface from a browser.

Example:

https://ucs01.pinoylinux.intranet/

or:

https://192.168.100.75/

Log in using the UCS administrator account.

The UCS manual includes the UCS web interface and management modules as part of the administration workflow.



Illustration 3: The UCS web interface is used to manage users, groups, shares, and domain settings.


Step 3: Confirm LDAP Service on UCS

UCS stores directory information in LDAP. Before configuring the LTSP server, confirm that the UCS LDAP service is reachable from the LTSP server.

From the LTSP server:

getent hosts ucs01.pinoylinux.intranet
ping -c 4 ucs01.pinoylinux.intranet

If DNS is not configured yet, add a temporary entry on the LTSP server:

sudo nano /etc/hosts

Example:

192.168.100.75 ucs01.pinoylinux.intranet ucs01

Test again:

getent hosts ucs01.pinoylinux.intranet

Step 4: Create a User in UCS

In the UCS web interface, open:

Users

Create a test user.

Example:

Username:     student01
First name:   Student
Last name:    One
Password:     Set a test password

The UCS manual includes user management through the Univention Management Console module.

Illustration 4: Users are created centrally in UCS instead of locally on each LTSP client.

Step 5: Confirm the User Has Linux Account Attributes

For Linux login, the user must have Unix or POSIX account attributes.

Confirm that the UCS user has:

Username
UID number
Primary group or GID
Home directory
Login shell

Example:

Username:        student01
Home directory:  /home/student01
Login shell:     /bin/bash

  
Illustration 5: The UCS user must have Linux account attributes so the LTSP server can map the login to a UID, GID, shell, and home directory.

If the user has no Linux attributes, the LTSP server may not be able to resolve the user correctly through LDAP.

Step 6: Prepare the Home Directory on UCS

The user’s home directory must exist on the UCS server.

Example:

/home/student01

If UCS creates the home directory automatically based on user settings, confirm that it exists.

On the UCS server:

ls -ld /home/student01

Check numeric ownership:

ls -ldn /home/student01

Example result:

drwx------ 10 20001 5001 4096 Jul 10 10:00 /home/student01

The numeric UID and GID should match the user data from UCS LDAP.

Step 7: Configure /home as an NFS Share in UCS

In the UCS web interface, open:

Shares

Create or confirm a share for /home.

Example settings:

Share name:   home
Server:       ucs01
Path:         /home
NFS:          Enabled
Samba/CIFS:   Optional, depending on your environment

UCS supports central file share management through the UMC module. A share registered in the UMC Shares module is created on a UCS server as part of UCS domain replication. UCS shares can be made available through CIFS or NFS, and NFS shares managed by UCS can be mounted by NFSv3 or NFSv4 clients.

Illustration 6: The /home directory is shared from UCS so LTSP users can access the same home directory from any thin client.

Illustration 7: NFS access is enabled for Linux clients that need to mount the centralized /home directory.

Step 8: Confirm NFS Export from UCS

From the LTSP server, install NFS client tools if they are not installed yet:

sudo apt update
sudo apt install -y nfs-common

Check the NFS exports from UCS:

showmount -e 192.168.100.75

Expected result:

Export list for 192.168.100.75:
/home 192.168.100.0/24

If the export does not appear, check the UCS share settings and firewall rules.

Step 9: Install SSSD and LDAP Tools on the LTSP Server

In the older lab notes, LDAP was configured through /etc/ldap.conf. For Ubuntu 24.04, a cleaner approach is to use SSSD.

SSSD can use LDAP for authentication, authorization, and user and group information. Ubuntu’s documentation shows SSSD with LDAP using packages such as sssd-ldap and ldap-utils.

Install the required packages:

sudo apt update
sudo apt install -y \
  sssd-ldap sssd-tools ldap-utils \
  libnss-sss libpam-sss \
  nfs-common

Step 10: Test UCS LDAP Lookup

Test LDAP lookup from the LTSP server.

If using plain LDAP in a closed lab:

ldapsearch -x \
  -H ldap://192.168.100.75 \
  -b "dc=pinoylinux,dc=intranet" \
  "(uid=student01)"

If using a bind account:

ldapsearch -x \
  -H ldap://192.168.100.75 \
  -D "uid=ldapbind,cn=users,dc=pinoylinux,dc=intranet" \
  -W \
  -b "dc=pinoylinux,dc=intranet" \
  "(uid=student01)"

For a real deployment, prefer StartTLS or LDAPS. Ubuntu’s SSSD with LDAP documentation notes that clients must trust the CA that signed the LDAP server certificate when using StartTLS with full certificate checking.

Do not hardcode real passwords in the public article.

Step 11: Configure SSSD for UCS LDAP

Create the SSSD configuration file:

sudo nano /etc/sssd/sssd.conf

Example configuration:

[sssd]
services = nss, pam
config_file_version = 2
domains = pinoylinux.intranet

[domain/pinoylinux.intranet]
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap

ldap_uri = ldap://192.168.100.75
ldap_search_base = dc=pinoylinux,dc=intranet
ldap_schema = rfc2307

cache_credentials = true
enumerate = false

fallback_homedir = /home/%u
default_shell = /bin/bash

If your UCS LDAP server requires a bind account, add:

ldap_default_bind_dn = uid=ldapbind,cn=users,dc=pinoylinux,dc=intranet
ldap_default_authtok_type = password
ldap_default_authtok = CHANGE_THIS_PASSWORD

For production, use StartTLS or LDAPS. Example StartTLS settings:

ldap_id_use_start_tls = true
ldap_tls_reqcert = demand
ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt

Set the correct permissions:

sudo chown root:root /etc/sssd/sssd.conf
sudo chmod 600 /etc/sssd/sssd.conf

Ubuntu’s SSSD documentation also states that /etc/sssd/sssd.conf should be owned by root and have 0600 permissions.

Start SSSD:

sudo systemctl enable --now sssd

Check status:

systemctl status sssd --no-pager

Step 12: Configure NSS and PAM

Edit NSS configuration:

sudo nano /etc/nsswitch.conf

Make sure these lines include sss:

passwd:         files systemd sss
group:          files systemd sss
shadow:         files sss

Run PAM configuration:

sudo pam-auth-update

Enable SSS authentication if prompted.

For this design, do not depend on local automatic home directory creation. The home directory should come from UCS through NFS.

Step 13: Test UCS User Lookup from Ubuntu

Clear SSSD cache:

sudo sss_cache -E

Test user lookup:

getent passwd student01

Expected result:

student01:*:20001:5001:Student One:/home/student01:/bin/bash

Test group lookup:

id student01

Expected result:

uid=20001(student01) gid=5001(students) groups=5001(students)

Step 14: Mount UCS /home Through NFS

Before mounting /home, remember this:

Mounting UCS /home over the local /home path hides the local /home folders while the NFS mount is active.

Keep a local admin account available for recovery.

Create a temporary test mount point:

sudo mkdir -p /mnt/ucs-home-test

Mount the UCS home directory:

sudo mount -t nfs4 192.168.100.75:/home /mnt/ucs-home-test

Check the mounted folder:

ls -lah /mnt/ucs-home-test
ls -lah /mnt/ucs-home-test/student01

Check numeric ownership:

ls -ldn /mnt/ucs-home-test/student01

Compare it with:

id student01

The UID and GID must match.

Unmount the test mount:

sudo umount /mnt/ucs-home-test

Step 15: Add UCS /home to /etc/fstab

Back up the current fstab:

sudo cp /etc/fstab /etc/fstab.bak.$(date +%F)

Edit fstab:

sudo nano /etc/fstab

Add this line:

192.168.100.75:/home  /home  nfs4  rw,_netdev,hard,noatime,x-systemd.automount,x-systemd.requires=network-online.target  0  0

Ubuntu’s NFS documentation covers installing and mounting NFS shares on Ubuntu systems. It also lists the NFS client package nfs-common for client-side NFS use.

Reload systemd:

sudo systemctl daemon-reload

Mount the entries:

sudo mount -a

Check the mount:

findmnt /home
df -h /home

Suggested screenshot:

[Screenshot: LTSP terminal showing findmnt /home]
Caption: The LTSP server now mounts /home from UCS through NFS.

Step 16: Test Login with UCS User

Test from the LTSP server first:

su - student01

Check the home directory:

pwd
touch ~/ucs-nfs-test.txt
ls -lah ~/ucs-nfs-test.txt

Expected result:

/home/student01

Exit:

exit

If the file can be created, the UCS LDAP identity and UCS NFS home directory are working together.

Step 17: Confirm LightDM Manual Login

Check the LightDM configuration from Part 2:

cat /etc/lightdm/lightdm.conf.d/50-xfce.conf

Expected configuration:

[Seat:*]
greeter-session=lightdm-gtk-greeter
greeter-hide-users=true
greeter-show-manual-login=true
user-session=xfce
allow-guest=false

Restart LightDM:

sudo systemctl restart lightdm

Illustration 8: Users log in manually using their UCS username and password.

Step 18: Rebuild the LTSP Image

The LTSP clients need the SSSD, LDAP, PAM, NSS, and NFS configuration.

Rebuild the LTSP image:

sudo ltsp image /

Regenerate the LTSP initrd:

sudo ltsp initrd

If needed, regenerate the iPXE boot files:

sudo ltsp ipxe

Reboot a thin client through PXE and test login with the UCS user account.

Step 19: Test from the Thin Client

From the PXE-booted thin client:

1. Boot through PXE
2. Wait for the LightDM login screen
3. Enter the UCS username
4. Enter the UCS password
5. Confirm XFCE loads
6. Open a terminal
7. Confirm the user and home directory

Run:

whoami
pwd
id
touch ~/thin-client-ucs-test.txt
ls -lah ~/thin-client-ucs-test.txt

Expected:

whoami -> student01
pwd    -> /home/student01

If the file is created successfully, the thin client is using centralized authentication and centralized home storage.

Troubleshooting LDAP

ldapsearch fails

Check:

ping -c 4 192.168.100.75
getent hosts ucs01.pinoylinux.intranet

Check firewall and LDAP service on UCS.

ldapsearch works, but getent passwd student01 fails

Check SSSD:

systemctl status sssd --no-pager
journalctl -u sssd -n 100 --no-pager

Check file permissions:

ls -l /etc/sssd/sssd.conf

Expected:

-rw------- 1 root root /etc/sssd/sssd.conf

Clear cache:

sudo sss_cache -E
getent passwd student01

Login fails, but user lookup works

Run:

sudo pam-auth-update

Make sure SSS authentication is enabled.

Check that the UCS user has a valid shell and home directory.

getent passwd student01

Troubleshooting NFS

NFS export does not appear

Run:

showmount -e 192.168.100.75

If /home does not appear, review the UCS Shares module and confirm NFS is enabled.

Permission denied inside /home/student01

Check numeric ownership:

id student01
ls -ldn /home/student01

The UID and GID must match.

Server hangs during boot after adding NFS

Use systemd automount in /etc/fstab:

x-systemd.automount

This allows /home to mount when first accessed instead of blocking the boot process too early.

Security Notes

For lab use, plain LDAP and basic NFS may work.

For production-style deployments, review these controls:

Use StartTLS or LDAPS for LDAP.
Use a low-privilege LDAP bind account.
Do not publish LDAP passwords.
Restrict NFS exports to trusted networks.
Prefer NFSv4 where possible.
Keep local admin access for recovery.
Back up UCS LDAP and /home data.
Use firewall rules to limit LDAP and NFS access.

LDAP protects identity. NFS protects user files. Both must be configured carefully.

What We Completed

In this part, we updated the thin client design to use UCS as the central backend.

We completed the following:

Explained what LDAP does
Explained what NFS does
Explained why UCS fits the LTSP design
Prepared UCS as the LDAP and NFS backend
Created a UCS user
Confirmed Linux account attributes
Configured a UCS /home NFS share
Installed SSSD and NFS tools on Ubuntu 24.04
Connected the LTSP server to UCS LDAP
Mounted UCS /home through NFS
Tested UCS user login
Rebuilt the LTSP image
Tested the setup from a PXE-booted thin client

At this point, the LTSP thin client environment has centralized login and centralized user files through UCS.

What Comes Next

In Part 4, we will configure the managed desktop experience.

We will focus on XFCE, LightDM behavior, and Google Chrome Stable kiosk mode. The goal is to control what users see after login and launch a full-screen browser session when needed.

References

Univention Corporate Server 5.2 Manual
https://docs.software-univention.de/manual/5.2/en/contents.html

Univention Corporate Server Installation
https://docs.software-univention.de/manual/5.2/en/installation.html

Univention Corporate Server File Share Management
https://docs.software-univention.de/manual/5.2/en/shares/index.html

Ubuntu Server Documentation, SSSD with LDAP
https://ubuntu.com/server/docs/how-to/sssd/with-ldap/

Ubuntu Server Documentation, Network File System
https://ubuntu.com/server/docs/how-to/networking/install-nfs/

LTSP Documentation
https://ltsp.org/docs/

LTSP Installation Guide
https://ltsp.org/docs/installation/

LTSP Manual
https://ltsp.org/man/ltsp/