Somehow I've managed to damage the ipa server configuration so that ipal users cannot login anymore. Local users work fine. Using the console on the ipa server:
Login: ... Password: ...
System error
Messages in /var/log/secure say:
-- ... login[25478]: pam_sss(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost= user=USERNAME ... login[25478]: pam_sss(login:auth): received for user USERNAME: 12 (Authentication token is no longer valid; new one required) ... login[25478]: pam_sss(login:account): Access denied for user USERNAME: 4 (System error) ... login[25478]: System error --
I've no idea what the problem could be. (The "no longer valid" message is because it's the initial password that needs to be changed.)
Ciao
Dominik ^_^ ^_^
--
Dominik Vogt
On Mon, Oct 05, 2020 at 11:46:34AM +0100, Dominik Vogt wrote:
Somehow I've managed to damage the ipa server configuration so that ipal users cannot login anymore. Local users work fine. Using the console on the ipa server:
Login: ... Password: ...
System error
Messages in /var/log/secure say:
-- ... login[25478]: pam_sss(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost= user=USERNAME ... login[25478]: pam_sss(login:auth): received for user USERNAME: 12 (Authentication token is no longer valid; new one required) ... login[25478]: pam_sss(login:account): Access denied for user USERNAME: 4 (System error) ... login[25478]: System error --
Okay, figured it out myself with some searches in the web. I had created mappings to SELinux users for user groups, but the SELinux users don't exist yet. Erasing the mappings fixes the problem.
Ciao
Dominik ^_^ ^_^
--
Dominik Vogt
freeipa-users@lists.fedorahosted.org