[SSSD-users] sssd with ad backend, pam problems

Stefan Schäfer ml at fsproductions.de
Thu Aug 28 14:00:28 UTC 2014


Hello list,

this is my first try here.

I've a problem with a sssd_ad setup with a samba 4 ad domain.

Samba domain is created with rfc2307 scheme. sssd works, getent passwd 
shows users and groups with UNIX-attributes from the ad, but login is 
impossible.

The setup is based on openSUSE 13.1 with sssd updated to version 1.12 
and the sernet samba packages version 4.1.11.

My sssd configuration:

--------------------------------------------------
[sssd]
services = nss,pam
config_file_version = 2
domains = invis-ad.loc
debug_level = 5

[nss]

[pam]

[domain/invis-ad.loc]
# Using id_provider=ad sets the best defaults on its own
id_provider = ad
# In sssd, the default access provider is always 'permit'. The AD access
# provider by default checks for account expiration
access_provider = ad

# Authentication
auth_provider = ad

# Uncomment to use POSIX attributes on the server
ldap_id_mapping = false

# Uncomment if the client machine hostname doesn't match the computer 
object on the DC.
ad_hostname = invisad.invis-ad.loc

# Uncomment if DNS SRV resolution is not working
ad_server = invisad.invis-ad.loc

# Uncomment if the domain section is named differently than your Samba 
domain
ad_domain = invis-ad.loc

# Enumeration is discouraged for performance reasons.
enumerate = true

---------------------------------------------------------------------------------------------------------------------------------
nsswitch.conf
....
passwd compat sss
group compat sss
.....

----------------------------------------------------------------------------------------------------------------------

getent passwd:

....
hbecker:*:10000:10000:Heinz Becker:/home/hbecker:/bin/bash

This is exactly what is stored in the ad.

The pam configuration:

common-auth
------------------------------------------------------------------------------------------------------------------
#%PAM-1.0
auth    required        pam_env.so
auth    sufficient      pam_unix.so     try_first_pass
auth    sufficient      pam_sss.so      use_first_pass

common-account
-------------------------------------------------------------------------------------------------------------------
#%PAM-1.0
account requisite       pam_unix.so     try_first_pass
account sufficient      pam_localuser.so
account        [default=bad success=ok user_unknown=ignore] pam_sss.so

common-password
-------------------------------------------------------------------------------------------------------------------
password        requisite       pam_cracklib.so
password        sufficient      pam_unix.so     use_authtok nullok 
try_first_pass
password        sufficient      pam_sss.so      use_authtok

common-session
--------------------------------------------------------------------------------------------------------------------
#%PAM-1.0
session required        pam_limits.so
session required        pam_unix.so     try_first_pass
session optional        pam_sss.so
session optional        pam_umask.so
session optional        pam_systemd.so
session optional        pam_env.so

---------------------------------------------------------------------------------------------------------------------

Here the logs from different login tries:

1. non-existing user

2014-08-28T15:52:29.560167+02:00 invisad login: pam_unix(login:auth): 
check pass; user unknown
2014-08-28T15:52:29.560490+02:00 invisad login: pam_unix(login:auth): 
authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= rhost=
2014-08-28T15:52:29.567475+02:00 invisad login: pam_sss(login:auth): 
authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= 
rhost= user=oierwe
2014-08-28T15:52:29.569417+02:00 invisad login: pam_sss(login:auth): 
received for user oierwe: 10 (User not known to the underlying 
authentication module)
2014-08-28T15:52:29.572497+02:00 invisad login: pam_unix(login:account): 
could not identify user (from getpwnam(oierwe))
2014-08-28T15:52:29.573783+02:00 invisad login: User not known to the 
underlying authentication module

seems to be ok.

2. existing user, wrong password

2014-08-28T15:53:33.988971+02:00 invisad login: pam_unix(login:auth): 
authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= 
rhost=  user=hbecker
2014-08-28T15:53:34.090927+02:00 invisad [sssd[krb5_child[16213]]]: #020
2014-08-28T15:53:34.101970+02:00 invisad login: pam_sss(login:auth): 
authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= 
rhost= user=hbecker
2014-08-28T15:53:34.103406+02:00 invisad login: pam_sss(login:auth): 
received for user hbecker: 17 (Failure setting user credentials)
2014-08-28T15:53:34.104581+02:00 invisad login: pam_sss(login:account): 
Access denied for user hbecker: 4 (System error)
2014-08-28T15:53:34.105607+02:00 invisad login: System error

seems to be ok.

3. existing user, correct password:

2014-08-28T15:54:39.661506+02:00 invisad login: pam_unix(login:auth): 
authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= 
rhost=  user=hbecker
2014-08-28T15:54:39.780648+02:00 invisad [sssd[krb5_child[16218]]]: #020
2014-08-28T15:54:39.791159+02:00 invisad login: pam_sss(login:auth): 
authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= 
rhost= user=hbecker
2014-08-28T15:54:39.793320+02:00 invisad login: pam_sss(login:auth): 
received for user hbecker: 4 (System error)
2014-08-28T15:54:39.795032+02:00 invisad login: pam_sss(login:account): 
Access denied for user hbecker: 4 (System error)
2014-08-28T15:54:39.796398+02:00 invisad login: System error

2 times "system error", definitely not the expected result.

Any ideas?

With hope for help, regards

Stefan

-- 
www.invis-server.org

Stefan Schäfer
Ludwigstr. 1-3
63679 Schotten



More information about the sssd-users mailing list