Hi all,

I'm running into problems on a RHEL6 machine with configuring sssd. 
I keep getting errors like this:

Sep 30 14:11:26 tst0030 sshd[7512]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=somehost.domain.com  user=XXX
Sep 30 14:11:27 tst0030 sshd[7512]: Failed password for XXX21358 from 12.34.56.78 port 32950 ssh2
Sep 30 14:11:33 tst0030 sshd[7512]: Failed password for XXX21358 from 12.34.56.78 port 32950 ssh2



However, I can perform a ldapsearch succesfully. So LDAP is available. 

I've copied the configuration from a working RHEL5 machine(which runs just fine, I can login with the same credentials I try on the RHEL6 box), but it appears to be a no-go for now. sssd.conf looks like this:

[sssd]
config_file_version = 2

# Number of times services should attempt to reconnect in the
# event of a crash or restart before they give up
reconnection_retries = 3

# If a back end is particularly slow you can raise this timeout here
sbus_timeout = 30
services = nss, pam

# SSSD will not start if you do not configure any domains.
# Add new domain configurations as [domain/<NAME>] sections, and
# then add the list of domains (in the order you want them to be
# queried) to the "domains" attribute below and uncomment it.
domains = default

[nss]
# The following prevents SSSD from searching for the root user/group in
# all domains (you can add here a comma-separated list of system accounts that
# are always going to be /etc/passwd users, or that you want to filter out).
filter_groups = root
filter_users = root
reconnection_retries = 3

# The entry_cache_timeout indicates the number of seconds to retain an
# entry in cache before it is considered stale and must block to refresh.
# The entry_cache_nowait_timeout indicates the number of seconds to
# wait before updating the cache out-of-band. (NSS requests will still
# be returned from cache until the full entry_cache_timeout). Setting this
# value to 0 turns this feature off (default).
; entry_cache_timeout = 600
; entry_cache_nowait_timeout = 300

[pam]
reconnection_retries = 3
#offline_credentials_expiration = 0
#offline_failed_login_attempts = 5
#offline_failed_login_delays = 15

[domain/default]
ldap_id_use_start_tls = False
cache_credentials = True
ldap_search_base = ou=TST_EMEA_NL-TST01,ou=Locations,ou=NXDI,o=NXP
ldap_user_search_base = ou=People,ou=NXDI,o=NXP
ldap_user_object_class = NxpUserAuxClass
ldap_user_principal = krbForeignPrincipalName
ldap_force_upper_case_realm = True
ldap_user_fullname = fullName
ldap_user_member_of = groupMembership
ldap_group_search_base = ou=Group,ou=NXDI,o=NXP
ldap_group_object_class = NxpGroupAuxClass
ldap_group_gid_number = gidNumber
ldap_schema = rfc2307bis
enumerate = True
krb5_realm = WBI.NXP.COM
chpass_provider = krb5
krb5_kdcserver = wbi.nxp.com
id_provider = ldap
auth_provider = krb5
debug_level = 0
ldap_uri = ldap://dtc0001.dtq.nl-htc01.nxp.com,ldap://dtc0002.dtq.nl-htc01.nxp.com
krb5_kpasswd = wbi.nxp.com
ldap_tls_cacertdir = /etc/openldap/cacerts


I've modified nsswitch.conf to use sss, and also the system-auth to use the sssd-pam library. These look like:

auth        required      pam_env.so
auth        sufficient    pam_unix.so likeauth nullok
auth        requisite    pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_sss.so use_first_pass
auth        required      pam_deny.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_sss.so
account     required      pam_permit.so
#account     required      pam_access.so accessfile=/etc/security/access.netgroup.conf

password    requisite     pam_cracklib.so try_first_pass retry=3
password    sufficient    pam_unix.so nullok use_authtok md5 shadow
password    sufficient    pam_sss.so use_authtok
password    required      pam_deny.so

#session     required      pam_limits.so
session     required      pam_unix.so
session      required      pam_keyinit.so revoke
session     optional      pam_sss.so

Anyone who can help me out with this ? I'm kinda stuck. Google didn't show up any useful results. 

cheers,
Andy