Am Thu, Apr 07, 2022 at 08:19:47PM +0200 schrieb Francis Augusto Medeiros-Logeay:
--
Francis Augusto Medeiros-Logeay
Oslo, Norway
> Hi,
>
> iirc there is a special VMware PAM module which let user pass without
> entering the password if they are already authenticated at the VMware
> infrastructure. So I would expect that pam_sss is not called at all.
> Additionally, pam_sss would always need a password to get a TGT with the
> help of the SSSD backend.
>
> bye,
> Sumit
Thanks Sumit.
I traced what happens when I connect again via the Horizon client. It seems
that system-auth, and not the VMware module, is called (well, at least not
the vmtoolsd under pam.d). I would assume a password is sent, as this
scenario I am mentioning involves passwords - like for example when one
closes the client and connect again.
Hi,
can you check /var/log/secure or the journal to see which PAM modules
are used during authentication? Additionally setting 'debug_level = 9'
in the [pam] and [domain/...] sections of sssd.conf would enable
debugging in SSSD which might help to understand if SSSD is called
suring authentication and if yes what happens to the TGT request.
bye,
Sumit
Best,
Francis