Hi all,

In our setup, we run into the following problem: When sssd is configured, the authentication against ldap fails, but succeeds against kerberos/AD. Our ldap/edirectory guru has, as far as he is concerned, pinned the problem down due to the fact that ldap authentication fails with the logging saying "password failed":

Here's the part in /var/log/secure:

Aug 30 11:45:36 hpdw0001 sshd[27645]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=hpdw0001.ddns.nl-htc01.nxp.com
user=nxp21358
Aug 30 11:45:36 hpdw0001 sshd[27645]: pam_sss(sshd:auth): received for user nxp21358: 6 (Permission denied)
Aug 30 11:45:38 hpdw0001 sshd[27645]: Failed password for nxp21358 from 134.27.211.178 port 51963 ssh2

And the part in /var/log/sssd/

(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (6): calling ldap_search_ext with [(&(uid=nxp21358)(objectclass=NxpUserAuxClass))][ou=TS
T_EMEA_NL-TST01,ou=Locations,ou=NXDI,o=NXP].
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [objectClass]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [uid]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [userPassword]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [uidNumber]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [gidNumber]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [gecos]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [homeDirectory]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [loginShell]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [krbPrincipalName]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [cn]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [modifyTimestamp]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowLastChange]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowMin]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowMax]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowWarning]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowInactive]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowExpire]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [shadowFlag]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [krbLastPwdChange]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [krbPasswordExpiration]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (7): Requesting attrs: [pwdAttribute]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_send] (8): ldap_search_ext called, msgid = 9
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x4d1eeb0], connected[1], ops[0x4d5be80], ldap[0x4d1f060]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_parse_entry] (9): OriginalDN: [cn=nxp21358,ou=Personal,ou=People,ou=NXDI,o=NXP].
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x4d1eeb0], connected[1], ops[0x4d5be80], ldap[0x4d1f060]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_generic_done] (6): Search result: Success(0),
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_get_initgr_user] (9): Receiving info for the user
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0x4d1eeb0], connected[1], ops[(nil)], ldap[0x4d1f060]
(Mon Aug 30 11:45:33 2010) [sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing!



Now, browsing through the options that can be set, we sat that we were able to set an ldap_default_authtok_type. However, the only possible option here is "password". However, the object "password" is unknown in eDirectory. All other options can be set/remapped to other attributes, and this particular one cannot. Is there a work around for this that anyone knows of ?

best regards,
Andy