URL:
https://github.com/SSSD/sssd/pull/789
Title: #789: pam_sss: PAM_USER_UNKNOWN if socket is missing
sumit-bose commented:
"""
How do I reproduce it? I have:
```
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000
quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so
```
```shell
[root@f29 vagrant]# systemctl stop sssd
```
But I can still login:
```shell
[vagrant@f29 ~]$ su vagrant
Password:
[vagrant@f29 ~]$
```
Hi Pavel,
thanks for looking at this PR.
The use case is that the user comes from a different NSS module, neither files or sss, and
must have a UID larger than 1000 so that both pam_localuser and pam_succeed_if are
skipped.
You can "emulate" this behavior with a local user by removing pam_localuser and
pam_succeed_if.
Btw, if you have other ideas or prefer to solve the issue differently please let me
know.
bye,
Sumit
"""
See the full comment at
https://github.com/SSSD/sssd/pull/789#issuecomment-476556061