Stephen,<br><br>I've tried to rearrange the system-auth. However, when offline, I still cannot login with KDE.<br>the system-auth looks like this:<br><br>#%PAM-1.0<br># This file is auto-generated.<br># User changes will be destroyed the next time authconfig is run.<br>
auth required pam_env.so<br>auth sufficient pam_unix.so likeauth nullok<br>account sufficient pam_succeed_if.so uid > 500 quiet<br>auth sufficient pam_sss.so use_first_pass<br>auth required pam_deny.so<br>
<br>account sufficient pam_localuser.so<br>account required pam_unix.so broken_shadow<br>account sufficient pam_succeed_if.so uid > 500 quiet<br>account [default=bad success=ok user_unknown=ignore] pam_sss.so<br>
account required pam_permit.so<br>#account required pam_access.so accessfile=/etc/security/access.netgroup.conf<br><br>password requisite pam_cracklib.so try_first_pass retry=3<br>password sufficient pam_unix.so nullok use_authtok md5 shadow<br>
password sufficient pam_sss.so use_authtok<br>password required pam_deny.so<br><br>#session required pam_limits.so<br>session required pam_unix.so<br>session required pam_keyinit.so revoke<br>
session optional pam_sss.so<br><br>cheers,<br>Andy<br><br><div class="gmail_quote">2011/1/27 Stephen Gallagher <span dir="ltr"><<a href="mailto:sgallagh@redhat.com">sgallagh@redhat.com</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<div><div></div><div class="h5"><br>
On 01/27/2011 10:06 AM, Andy Kannberg wrote:<br>
> Hi,<br>
><br>
> I've got the SSSD packages from RHEL 5.6 installed on a RHEL 5.4 system.<br>
> SSSD works fine on the command line and when logging in via KDE. Also<br>
> logging on with cached credentials (when network is off) works like a<br>
> charm, on the command line.<br>
> When I want to login with cached credentials via KDE (network<br>
> disabled.), it goes wrong. KDE throws me a new login prompt, saying I<br>
> used te wrong userid or password.<br>
><br>
> When I check the /var/log/secure file, I see the following happens:<br>
><br>
><br>
> Jan 27 15:59:49 hpdw0001 su: pam_unix(su-l:session): session closed for<br>
> user root<br>
> Jan 27 16:00:01 hpdw0001 crond[21924]: pam_unix(crond:session): session<br>
> opened for user root by (uid=0)<br>
> Jan 27 16:00:01 hpdw0001 crond[21924]: pam_unix(crond:session): session<br>
> closed for user root<br>
> Jan 27 16:00:20 hpdw0001 gdm[3744]: pam_unix(gdm:session): session<br>
> closed for user nxp21358<br>
> Jan 27 16:00:20 hpdw0001 gdm[3744]: pam_console(gdm:session): getpwnam<br>
> failed for nxp21358<br>
> Jan 27 16:00:39 hpdw0001 gdm[3744]: pam_unix(gdm:auth): check pass; user<br>
> unknown<br>
> Jan 27 16:00:39 hpdw0001 gdm[3744]: pam_unix(gdm:auth): authentication<br>
> failure; logname= uid=0 euid=0 tty=:0 ruser= rhost=<br>
> Jan 27 16:00:39 hpdw0001 gdm[3744]: pam_sss(gdm:auth): User info<br>
> message: Authenticated with cached credentials.<br>
> Jan 27 16:00:39 hpdw0001 gdm[3744]: pam_sss(gdm:auth): authentication<br>
> success; logname= uid=0 euid=0 tty=:0 ruser= rhost= user=nxp21358<br>
> Jan 27 16:00:39 hpdw0001 gdm[3744]: pam_succeed_if(gdm:account): error<br>
> retrieving information about user nxp21358<br>
> Jan 27 16:00:39 hpdw0001 gdm[3744]: pam_unix(gdm:account): could not<br>
> identify user (from getpwnam(nxp21358))<br>
> Jan 27 16:00:49 hpdw0001 gdm[3744]: pam_unix(gdm:auth): check pass; user<br>
> unknown<br>
> Jan 27 16:00:49 hpdw0001 gdm[3744]: pam_unix(gdm:auth): authentication<br>
> failure; logname= uid=0 euid=0 tty=:0 ruser= rhost=<br>
> Jan 27 16:00:49 hpdw0001 gdm[3744]: pam_sss(gdm:auth): User info<br>
> message: Authenticated with cached credentials.<br>
> Jan 27 16:00:49 hpdw0001 gdm[3744]: pam_sss(gdm:auth): authentication<br>
> success; logname= uid=0 euid=0 tty=:0 ruser= rhost= user=nxp21358<br>
> Jan 27 16:00:49 hpdw0001 gdm[3744]: pam_succeed_if(gdm:account): error<br>
> retrieving information about user nxp21358<br>
> Jan 27 16:00:49 hpdw0001 gdm[3744]: pam_unix(gdm:account): could not<br>
> identify user (from getpwnam(nxp21358))<br>
> Jan 27 16:00:58 hpdw0001 gdm[3744]: pam_unix(gdm:auth): check pass; user<br>
> unknown<br>
> Jan 27 16:00:58 hpdw0001 gdm[3744]: pam_unix(gdm:auth): authentication<br>
> failure; logname= uid=0 euid=0 tty=:0 ruser= rhost=<br>
> Jan 27 16:00:58 hpdw0001 gdm[3744]: pam_sss(gdm:auth): User info<br>
> message: Authenticated with cached credentials.<br>
> Jan 27 16:00:58 hpdw0001 gdm[3744]: pam_sss(gdm:auth): authentication<br>
> success; logname= uid=0 euid=0 tty=:0 ruser= rhost= user=nxp21358<br>
> Jan 27 16:00:58 hpdw0001 gdm[3744]: pam_succeed_if(gdm:account): error<br>
> retrieving information about user nxp21358<br>
> Jan 27 16:00:58 hpdw0001 gdm[3744]: pam_unix(gdm:account): could not<br>
> identify user (from getpwnam(nxp21358))<br>
> Jan 27 16:01:01 hpdw0001 crond[21958]: pam_unix(crond:session): session<br>
> opened for user root by (uid=0)<br>
> Jan 27 16:01:11 hpdw0001 crond[21958]: pam_unix(crond:session): session<br>
> closed for user root<br>
> Jan 27 16:01:39 hpdw0001 gdm[3744]: pam_unix(gdm:auth): authentication<br>
> failure; logname= uid=0 euid=0 tty=:0 ruser= rhost= user=nxp21358<br>
> Jan 27 16:01:39 hpdw0001 gdm[3744]: pam_sss(gdm:auth): authentication<br>
> success; logname= uid=0 euid=0 tty=:0 ruser= rhost= user=nxp21358<br>
> Jan 27 16:01:39 hpdw0001 gdm[3744]: pam_unix(gdm:session): session<br>
> opened for user nxp21358 by (uid=0)<br>
> Jan 27 16:01:50 hpdw0001 su: pam_unix(su-l:auth): authentication<br>
> failure; logname=nxp21358 uid=3396 euid=0 tty=pts/8 ruser=nxp21358<br>
> rhost= user=root<br>
> Jan 27 16:01:56 hpdw0001 su: pam_unix(su-l:session): session opened for<br>
> user root by nxp21358(uid=3396)<br>
><br>
> I'm not a PAM expert, but what I get from this, is that the pam_succeed<br>
> module triggers a fail because pam_unix cannot find the user. How can I<br>
> solve this ??<br>
<br>
</div></div>I think you probably want pam_succeed_if to be above pam_sss in your PAM<br>
stack. Here's what mine looks like:<br>
<br>
<br>
#%PAM-1.0<br>
# This file is auto-generated.<br>
# User changes will be destroyed the next time authconfig is run.<br>
auth required pam_env.so<br>
auth sufficient pam_unix.so nullok try_first_pass<br>
auth requisite pam_succeed_if.so uid >= 500 quiet<br>
auth sufficient pam_sss.so use_first_pass<br>
auth required pam_deny.so<br>
<br>
account required pam_unix.so broken_shadow<br>
account sufficient pam_localuser.so<br>
account sufficient pam_succeed_if.so uid < 500 quiet<br>
account [default=bad success=ok user_unknown=ignore] pam_sss.so<br>
account required pam_permit.so<br>
<br>
password requisite pam_cracklib.so try_first_pass type=<br>
password sufficient pam_unix.so sha512 shadow nullok<br>
try_first_pass use_authtok<br>
password sufficient pam_sss.so use_authtok<br>
password required pam_deny.so<br>
<br>
session optional pam_keyinit.so revoke<br>
session required pam_limits.so<br>
session optional pam_mkhomedir.so<br>
session [success=1 default=ignore] pam_succeed_if.so service in<br>
crond quiet use_uid<br>
session required pam_unix.so<br>
session optional pam_sss.so<br>
<br>
<br>
<br>
<br>
- --<br>
Stephen Gallagher<br>
RHCE 804006346421761<br>
<br>
Delivering value year after year.<br>
Red Hat ranks #1 in value among software vendors.<br>
<a href="http://www.redhat.com/promo/vendor/" target="_blank">http://www.redhat.com/promo/vendor/</a><br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v1.4.11 (GNU/Linux)<br>
Comment: Using GnuPG with Fedora - <a href="http://enigmail.mozdev.org/" target="_blank">http://enigmail.mozdev.org/</a><br>
<br>
iEYEARECAAYFAk1BiwcACgkQeiVVYja6o6NuTwCePD6TfWA0/491XYipAeSR51ak<br>
TVEAn2TBnxXZWXVKEafWAou+KgbR/eZe<br>
=FoQ0<br>
-----END PGP SIGNATURE-----<br>
</blockquote></div><br>