[SSSD-users] sssd-users Digest, Vol 18, Issue 25

Jakub Hrozek jhrozek at redhat.com
Thu Oct 24 14:24:41 UTC 2013


On Thu, Oct 24, 2013 at 02:01:11PM +0100, Roberts Klotiņš wrote:
> Hi Thanks a lot for looking into this.
> 
> As you suspected - there is something that enterprise simple login added
> into the config file file:
> 
> [sssd]
> services = nss, pam
> config_file_version = 2
> domains = PEOPLE
> 
> [nss]
> filter_users = root
> filter_groups = root
> 
> [pam]
> 
> [domain/PEOPLE]
> description = PEOPLE AD domain
> id_provider = ad
> auth_provider = ad
> access_provider = ad
> chpass_provider = ad
> 
> ad_server = srv1.people.local
> ad_hostname = client1.people.local
> ad_domain = PEOPLE.LOCAL
> case_sensitive = false
> 
> enumerate = true
> cache_credentials = true
> simple_allow_users = usr1, usr2

Did you modify the config file anyhow? I find it suprising that there is
both "access_provider=ad" and "simple_allow_users". For the simple allow
users to work, I would have expected "access_provider=simple".

> 
> However when I deleted the last line in this file I got the same result.
> /var/log/secure
> datet:42:54 robbie gdm-password]: pam_unix(gdm-password:auth):
> authentication failure; logname=(unknown) uid=0 euid=0 tty=:1 ruser
> = rhost=  user=PEOPLE\usr2
> datet:42:54 robbie gdm-password]: pam_sss(gdm-password:auth):
> authentication failure; logname=(unknown) uid=0 euid=0 tty=:1 ruser=
>  rhost= user=PEOPLE\usr2
> datet:42:54 robbie gdm-password]: pam_sss(gdm-password:auth): received for
> user PEOPLE\usr2: 6 (Permission denied)
> datet:42:59 robbie gdm-password]: pam_unix(gdm-password:auth): conversation
> failed
> datet:42:59 robbie gdm-password]: pam_unix(gdm-password:auth): auth could
> not identify password for [PEOPLE\usr2]
> datet:42:59 robbie gdm-password]: pam_sss(gdm-password:auth):
> authentication failure; logname=(unknown) uid=0 euid=0 tty=:1 ruser=
>  rhost= user=PEOPLE\usr2
> datet:42:59 robbie gdm-password]: pam_sss(gdm-password:auth): received for
> user PEOPLE\usr2: 7 (Authentication failure)
> 
> It appears I may need to configure something in pam, but maybe that is not
> the case??

Ah, in the /var/log/secure snippet you send earlier there was also
access denied, which is why I was suspecting the access provider to be
the problem.

Can you put debug_level=7 into the [domain] section, restart the SSSD
and attach the contents of /var/log/sssd/sssd_PEOPLE.log and
/var/log/sssd/krb5_child.log


More information about the sssd-users mailing list