9 a.m.
Hello list,
this is my first try here.
I've a problem with a sssd_ad setup with a samba 4 ad domain.
Samba domain is created with rfc2307 scheme. sssd works, getent passwd
shows users and groups with UNIX-attributes from the ad, but login is
impossible.
The setup is based on openSUSE 13.1 with sssd updated to version 1.12
and the sernet samba packages version 4.1.11.
My sssd configuration:
--------------------------------------------------
[sssd]
services = nss,pam
config_file_version = 2
domains = invis-ad.loc
debug_level = 5
[nss]
[pam]
[domain/invis-ad.loc]
# Using id_provider=ad sets the best defaults on its own
id_provider = ad
# In sssd, the default access provider is always 'permit'. The AD access
# provider by default checks for account expiration
access_provider = ad
# Authentication
auth_provider = ad
# Uncomment to use POSIX attributes on the server
ldap_id_mapping = false
# Uncomment if the client machine hostname doesn't match the computer
object on the DC.
ad_hostname = invisad.invis-ad.loc
# Uncomment if DNS SRV resolution is not working
ad_server = invisad.invis-ad.loc
# Uncomment if the domain section is named differently than your Samba
domain
ad_domain = invis-ad.loc
# Enumeration is discouraged for performance reasons.
enumerate = true
---------------------------------------------------------------------------------------------------------------------------------
nsswitch.conf
....
passwd compat sss
group compat sss
.....
----------------------------------------------------------------------------------------------------------------------
getent passwd:
....
hbecker:*:10000:10000:Heinz Becker:/home/hbecker:/bin/bash
This is exactly what is stored in the ad.
The pam configuration:
common-auth
------------------------------------------------------------------------------------------------------------------
#%PAM-1.0
auth required pam_env.so
auth sufficient pam_unix.so try_first_pass
auth sufficient pam_sss.so use_first_pass
common-account
-------------------------------------------------------------------------------------------------------------------
#%PAM-1.0
account requisite pam_unix.so try_first_pass
account sufficient pam_localuser.so
account [default=bad success=ok user_unknown=ignore] pam_sss.so
common-password
-------------------------------------------------------------------------------------------------------------------
password requisite pam_cracklib.so
password sufficient pam_unix.so use_authtok nullok
try_first_pass
password sufficient pam_sss.so use_authtok
common-session
--------------------------------------------------------------------------------------------------------------------
#%PAM-1.0
session required pam_limits.so
session required pam_unix.so try_first_pass
session optional pam_sss.so
session optional pam_umask.so
session optional pam_systemd.so
session optional pam_env.so
---------------------------------------------------------------------------------------------------------------------
Here the logs from different login tries:
1. non-existing user
2014-08-28T15:52:29.560167+02:00 invisad login: pam_unix(login:auth):
check pass; user unknown
2014-08-28T15:52:29.560490+02:00 invisad login: pam_unix(login:auth):
authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= rhost=
2014-08-28T15:52:29.567475+02:00 invisad login: pam_sss(login:auth):
authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser=
rhost= user=oierwe
2014-08-28T15:52:29.569417+02:00 invisad login: pam_sss(login:auth):
received for user oierwe: 10 (User not known to the underlying
authentication module)
2014-08-28T15:52:29.572497+02:00 invisad login: pam_unix(login:account):
could not identify user (from getpwnam(oierwe))
2014-08-28T15:52:29.573783+02:00 invisad login: User not known to the
underlying authentication module
seems to be ok.
2. existing user, wrong password
2014-08-28T15:53:33.988971+02:00 invisad login: pam_unix(login:auth):
authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser=
rhost= user=hbecker
2014-08-28T15:53:34.090927+02:00 invisad [sssd[krb5_child[16213]]]: #020
2014-08-28T15:53:34.101970+02:00 invisad login: pam_sss(login:auth):
authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser=
rhost= user=hbecker
2014-08-28T15:53:34.103406+02:00 invisad login: pam_sss(login:auth):
received for user hbecker: 17 (Failure setting user credentials)
2014-08-28T15:53:34.104581+02:00 invisad login: pam_sss(login:account):
Access denied for user hbecker: 4 (System error)
2014-08-28T15:53:34.105607+02:00 invisad login: System error
seems to be ok.
3. existing user, correct password:
2014-08-28T15:54:39.661506+02:00 invisad login: pam_unix(login:auth):
authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser=
rhost= user=hbecker
2014-08-28T15:54:39.780648+02:00 invisad [sssd[krb5_child[16218]]]: #020
2014-08-28T15:54:39.791159+02:00 invisad login: pam_sss(login:auth):
authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser=
rhost= user=hbecker
2014-08-28T15:54:39.793320+02:00 invisad login: pam_sss(login:auth):
received for user hbecker: 4 (System error)
2014-08-28T15:54:39.795032+02:00 invisad login: pam_sss(login:account):
Access denied for user hbecker: 4 (System error)
2014-08-28T15:54:39.796398+02:00 invisad login: System error
2 times "system error", definitely not the expected result.
Any ideas?
With hope for help, regards
Stefan
--
www.invis-server.org
Stefan Schäfer
Ludwigstr. 1-3
63679 Schotten