On la, 18 joulu 2021, Simon Matthews via FreeIPA-users wrote:
Thanks for the help.
Unfortunately, I must have missed something: the password that I set with "setattr userpassword=<>" is not accepted.
I set up another VM, configured it using the ipa-client-install script, and I can do "su <username>" on the client, but both a ssh login of a "passwd" command fails on the password.
Should I have configured my ipa server to also be a NIS server for the transition? I see that the server has a yp.conf files that appear to have been configured when I configured the ipa server and client.
You are importing your users and passwords from non-LDAP to LDAP, so there is no need to setup and use NIS anymore. IPA NIS server emulation also does not support exposing shadow map so auth via NIS will not work.
Looking at the 389-ds code, I think you should be using {crypt} prefix instead of {sha512}. SHA512 passwords stored differently to how UNIX CRYPT is done. See RHDS documentation for details, for example, https://access.redhat.com/documentation/en-us/red_hat_directory_server/11/ht...
This is also described in https://www.freeipa.org/page/NIS_accounts_migration_preserving_Passwords ------- NOTE: Use {crypt} for any password taken from an NIS dump or /etc/shadow. It defines the password storage scheme that crypt(3) uses. -------
Remove the test user and create it again, using --setattr userpassword={crypt}<hash-from-NIS>.
Then just try
ldapwhoami -Z -H ldap://ipa.server \ -D uid=<username>,cn=users,cn=accounts,dc=example,dc=test \ -W
This should output the same DN as in -D in the case of success and should be enough to verify that authentication is working.
If it is not, then either your password hash is incorrect for 389-ds or entered password is incorrect.