Dear Maintainer,

I just switched from libnss-ldap / OpenLDAP with TLS auth to
libnssd-ldap / Samba4 AD DC with Kerberos auth. So the issue might have
existed for some time.

During boot k5start fails:

Fri Oct 24 12:34:55 2014: [FAIL] Starting Keep alive Kerberos ticket: k5startk5start: error getting credentials: Cannot contact any KDC for realm 'AD.MICROSULT.DE'
Fri Oct 24 12:34:55 2014: [ ok ] Starting LDAP connection daemon: nslcd

which means that nslcd cannot read from the AD DC and all AD users are
unknown. Logging in as root following start-up and restarting nslcd by
/etc/init.d/nslcd restart
works fine and also starts k5start.

Could it be that it is run too early in the start-up?

However, NFS is started before nslcd and I use kerberized NFS4!

Regards,
 - lars

The problem is that obviously network configuration takes time and the
init script starts too early. I mitigated this by adding the following
to /etc/defaults/nslcd:

# wait for DNS
wait_for_dns(){
   log_action_begin_msg "Check for KDC"
   local HOST=/usr/bin/host
   local RETRY=5
   while [ $RETRY -gt 0 ]; do
     local DC=$($HOST -t SRV _kerberos._udp | sed '/^;;/d;s/^.* //')
     if [ -n "$DC" ]; then
       DC=$($HOST "$DC" | sed '/^;;/d;s/^.* //')
       if [ -n "$DC" ]; then
         log_action_end_msg 0 success
         return 0
       else
         log_action_cont_msg "KDC: $RETRY"
       fi
     else
       log_action_cont_msg "DNS: $RETRY"
     fi
     RETRY=$(($RETRY-1))
   done
   log_action_end_msg 20 fail
   return 20
}
if [ "$K5START_START" = "yes" ]; then
   wait_for_dns
fi

Okay, my KDC is an AD DC, so "_kerberos._udp" may not be valid in other
environments. But unless the boot sequence in itself will be changed,
some code like this in the k5start startup may do the trick. I fear that
the situation won't exactly improve with systemd.

The work-around did not work for me. I couldn't get the host command to
wait with -W 5 and didn't try shell wait. I use dnssec-trigger, a
validating resolver, which may have something to do with it. I also added
'-N 2' to host for better domain parsing and set my domain in
/etc/resolv.conf (in dnssec-trigger.conf, in my case).

I believe systemd will eventually make this better. For now, I tried the
Required-Start boot facility to have nslcd depend on dnsssec-trigger, but
that did not work. Some kind of retry interplay between k5start and nslcd
might also be useful.