[SSSD-users] sssd with ad backend, pam problems

Lukas Slebodnik lslebodn at redhat.com
Thu Aug 28 14:18:59 UTC 2014


On (28/08/14 16:13), Lukas Slebodnik wrote:
>On (28/08/14 16:00), Stefan Schäfer wrote:
>>Hello list,
>>
>>this is my first try here.
>>
>>I've a problem with a sssd_ad setup with a samba 4 ad domain.
>>
>>Samba domain is created with rfc2307 scheme. sssd works, getent passwd shows
>>users and groups with UNIX-attributes from the ad, but login is impossible.
>>
>>The setup is based on openSUSE 13.1 with sssd updated to version 1.12 and the
>>sernet samba packages version 4.1.11.
>>
>>My sssd configuration:
>>
>>--------------------------------------------------
>>[sssd]
>>services = nss,pam
>>config_file_version = 2
>>domains = invis-ad.loc
>>debug_level = 5
>>
>>[nss]
>>
>>[pam]
>>
>>[domain/invis-ad.loc]
>># Using id_provider=ad sets the best defaults on its own
>>id_provider = ad
>># In sssd, the default access provider is always 'permit'. The AD access
>># provider by default checks for account expiration
>>access_provider = ad
>>
>># Authentication
>>auth_provider = ad
>>
>># Uncomment to use POSIX attributes on the server
>>ldap_id_mapping = false
>>
>># Uncomment if the client machine hostname doesn't match the computer object
>>on the DC.
>>ad_hostname = invisad.invis-ad.loc
>>
>># Uncomment if DNS SRV resolution is not working
>>ad_server = invisad.invis-ad.loc
>>
>># Uncomment if the domain section is named differently than your Samba domain
>>ad_domain = invis-ad.loc
>>
>># Enumeration is discouraged for performance reasons.
>>enumerate = true
>>
>>---------------------------------------------------------------------------------------------------------------------------------
>>nsswitch.conf
>>....
>>passwd compat sss
>>group compat sss
>>.....
>>
>>----------------------------------------------------------------------------------------------------------------------
>>
>>getent passwd:
>>
>>....
>>hbecker:*:10000:10000:Heinz Becker:/home/hbecker:/bin/bash
>>
>>This is exactly what is stored in the ad.
>>
>>The pam configuration:
>>
>>common-auth
>>------------------------------------------------------------------------------------------------------------------
>>#%PAM-1.0
>>auth    required        pam_env.so
>>auth    sufficient      pam_unix.so     try_first_pass
>>auth    sufficient      pam_sss.so      use_first_pass
>>
>>common-account
>>-------------------------------------------------------------------------------------------------------------------
>>#%PAM-1.0
>>account requisite       pam_unix.so     try_first_pass
>>account sufficient      pam_localuser.so
>>account        [default=bad success=ok user_unknown=ignore] pam_sss.so
>>
>>common-password
>>-------------------------------------------------------------------------------------------------------------------
>>password        requisite       pam_cracklib.so
>>password        sufficient      pam_unix.so     use_authtok nullok
>>try_first_pass
>>password        sufficient      pam_sss.so      use_authtok
>>
>>common-session
>>--------------------------------------------------------------------------------------------------------------------
>>#%PAM-1.0
>>session required        pam_limits.so
>>session required        pam_unix.so     try_first_pass
>>session optional        pam_sss.so
>>session optional        pam_umask.so
>>session optional        pam_systemd.so
>>session optional        pam_env.so
>>
>>---------------------------------------------------------------------------------------------------------------------
>>
>>Here the logs from different login tries:
>>
>>1. non-existing user
>>
>>2014-08-28T15:52:29.560167+02:00 invisad login: pam_unix(login:auth): check
>>pass; user unknown
>>2014-08-28T15:52:29.560490+02:00 invisad login: pam_unix(login:auth):
>>authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= rhost=
>>2014-08-28T15:52:29.567475+02:00 invisad login: pam_sss(login:auth):
>>authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= rhost=
>>user=oierwe
>>2014-08-28T15:52:29.569417+02:00 invisad login: pam_sss(login:auth): received
>>for user oierwe: 10 (User not known to the underlying authentication module)
>>2014-08-28T15:52:29.572497+02:00 invisad login: pam_unix(login:account):
>>could not identify user (from getpwnam(oierwe))
>>2014-08-28T15:52:29.573783+02:00 invisad login: User not known to the
>>underlying authentication module
>>
>>seems to be ok.
>>
>>2. existing user, wrong password
>>
>>2014-08-28T15:53:33.988971+02:00 invisad login: pam_unix(login:auth):
>>authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= rhost=
>>user=hbecker
>>2014-08-28T15:53:34.090927+02:00 invisad [sssd[krb5_child[16213]]]: #020
>>2014-08-28T15:53:34.101970+02:00 invisad login: pam_sss(login:auth):
>>authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= rhost=
>>user=hbecker
>>2014-08-28T15:53:34.103406+02:00 invisad login: pam_sss(login:auth): received
>>for user hbecker: 17 (Failure setting user credentials)
>>2014-08-28T15:53:34.104581+02:00 invisad login: pam_sss(login:account):
>>Access denied for user hbecker: 4 (System error)
>
>sssd should not return 4 (System error).
>
>Could you put debug_level = 7 into domain section (in /etc/sssd/sssd.conf)
>then restart sssd; login as samba user;
>
>You should find a reason in sssd_invis-ad.loc.log file (/var/log/sssd)
>why sssd returned  4 (System error)
>

For wrong pasword you should se something similar.
[sssd[be[example.test]]] [simple_bind_done] (0x0400): Bind result: Invalid credentials(49), no errmsg set
[sssd[be[example.test]]] [ipa_auth_ldap_done] (0x0080): LDAP authentication failed, Password migration not possible.
[sssd[be[example.test]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 8, <NULL>) [Success]
[sssd[be[example.test]]] [be_pam_handler_callback] (0x0100): Sending result [8][example.test]
[sssd[be[example.test]]] [be_pam_handler_callback] (0x0100): Sent result [8][example.test]
                                                                         ^^^
                                                       value of pam error code

LS


More information about the sssd-users mailing list