Lukas and Sumit, thanks for your responses.
According to the logs your password has
13 characters, does this make sense?
No, my password doesn't have 13 characters.
I did notice that no matter
what I typed, the authtok size was always 13.
You PAM configuration is a bit unusual,
because you have pam_sss first and the
pam_unix. Can you try to switch the order?
I changed my pam configuration. Also, I
removed the 'access_provider' and
'ldap_access_filter' options just in case. I also tried changing from
'ldaps' to 'ldap + start_tls'. None of these seemed to fix the problem. I
have a ton of log output from sssd and my ldap server, would it help if I
posted some of the output?
On the ldap server side, I don't see any errors that are out of the
ordinary. I believe when it is reading password policy objects I see some
errors on the server side saying:
......INC
0030: 4f 52 52 45 43 54 a0 1d 30 1b 04 19 31 2e 33 2e
ORRECT..0...1.3.
0040: 36 2e 31 2e 34 2e 31 2e 34 32 2e 32 2e 32 37 2e
6.1.4.1.42.2.27.
0050: 38 2e 35 2e 31
8.5.1
But I have removed password policy before and seen no improvements.
return code 49 (0x31 LDAP_INVALID_CREDENTIALS)
is return only if there is problem with certificate.
I agree that it could be a
certificate problem, but the server side doesn't
seem to display any errors about certificates and sssd doesn't complain
(other than the error 49). I am able to use the same certificates with
ldapsearch. I changed both the client and server side to demand
certificates (ldap.conf and slapd.conf) and ldapsearch still works. I am
fairly confident in the certificates that I made today. I followed this
tutorial (
http://spectlog.com/content/Create_Certificate_Authority_(CA)_instead_of_...)
and made a CA and then signed two certificates with that CA.
Thanks for all the help so far!
Kevin