[SSSD] Problem with authentication via KDE
Stephen Gallagher
sgallagh at redhat.com
Fri Jan 28 15:11:35 UTC 2011
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 01/28/2011 09:23 AM, Andy Kannberg wrote:
> Hi Stephen,
>
> errors are getting fewer, but still the same problem:
>
> Jan 28 15:09:45 hpdw0001 gdm[3744]: pam_unix(gdm:auth): check pass; user
> unknown
> Jan 28 15:09:45 hpdw0001 gdm[3744]: pam_unix(gdm:auth): authentication
> failure; logname= uid=0 euid=0 tty=:0 ruser= rhost=
> Jan 28 15:09:45 hpdw0001 gdm[3744]: pam_succeed_if(gdm:auth): error
> retrieving information about user nxp21358
>
>
> system-auth now looks like :
>
> #%PAM-1.0
> # This file is auto-generated.
> # User changes will be destroyed the next time authconfig is run.
> auth required pam_env.so
> auth sufficient pam_unix.so likeauth nullok
> auth requisite pam_succeed_if.so uid >= 500 quiet
> auth sufficient pam_sss.so use_first_pass
> auth required pam_deny.so
>
> account required pam_unix.so broken_shadow
> account sufficient pam_localuser.so
> account sufficient pam_succeed_if.so uid < 500 quiet
> account [default=bad success=ok user_unknown=ignore] pam_sss.so
> account required pam_permit.so
> #account required pam_access.so
> accessfile=/etc/security/access.netgroup.conf
>
> password requisite pam_cracklib.so try_first_pass retry=3
> password sufficient pam_unix.so nullok use_authtok md5 shadow
> password sufficient pam_sss.so use_authtok
> password required pam_deny.so
>
> #session required pam_limits.so
> session required pam_unix.so
> session required pam_keyinit.so revoke
> session optional pam_sss.so
>
Sorry, I didn't realize before that you were using gdm, not kdm. GDM
also requires that you make the same changes you made to system-auth
into password-auth. (It's a long story, but it has to do with GDM's
parallel PAM stack solution to multiple authentication methods)
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk1C3KcACgkQeiVVYja6o6PEygCeP06ucGluHktONkl0x/tDmge3
ozAAn0/amqV84rSqla/if+iEYpA2AEVn
=/Ccf
-----END PGP SIGNATURE-----
More information about the sssd-devel
mailing list