<div dir="ltr"><div>Hi again, still trying to understand how to make the setup to work. <br><br></div>As the very last thing I thought to check into /etc/sysconfig/authconfig. What I found was that usekerberos and useldap were set to no. Maybe they (or at least kerberos) need to be set to yes?<br>
<br># cat /etc/sysconfig/authconfig <br>IPADOMAINJOINED=no<br>USEMKHOMEDIR=yes<br>USEPAMACCESS=no<br>CACHECREDENTIALS=yes<br>USESSSDAUTH=yes<br>USESHADOW=yes<br>USEWINBIND=no<br>USEDB=no<br>FORCELEGACY=no<br>USEFPRINTD=no<br>
USEHESIOD=no<br>FORCESMARTCARD=no<br>PASSWDALGORITHM=sha512<br>USELDAPAUTH=no<br>IPAV2NONTP=no<br>USELOCAUTHORIZE=yes<br>USEECRYPTFS=no<br>USEIPAV2=no<br>USEWINBINDAUTH=no<br>USESMARTCARD=no<br>USELDAP=no<br>USENIS=no<br>
USEKERBEROS=no<br>USESYSNETAUTH=no<br>USESSSD=yes<br>USEPWQUALITY=yes<br>USEPASSWDQC=no<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On 24 October 2013 15:02, Roberts Klotiņš <span dir="ltr"><<a href="mailto:roberts.klotins@gmail.com" target="_blank">roberts.klotins@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Sorry to trouble again with this. but I thought it might be relevant to look through pam modules; <br><br>
I found sss present as per system installation; I have not modified the file<br><div><br># cat /etc/pam.d/password-auth<br>
#%PAM-1.0<br># This file is auto-generated.<br># User changes will be destroyed the next time authconfig is run.<br>auth required pam_env.so<br>auth sufficient pam_unix.so nullok try_first_pass<br>auth requisite pam_succeed_if.so uid >= 1000 quiet_success<br>
auth sufficient pam_sss.so use_first_pass<br>auth required pam_deny.so<br><br>account required pam_unix.so broken_shadow<br>account sufficient pam_localuser.so<br>account sufficient pam_succeed_if.so uid < 1000 quiet<br>
account [default=bad success=ok user_unknown=ignore] pam_sss.so<br>account required pam_permit.so<br><br>password requisite pam_pwquality.so try_first_pass retry=3 authtok_type=<br>password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok<br>
password sufficient pam_sss.so use_authtok<br>password required pam_deny.so<br><br>session optional pam_keyinit.so revoke<br>session required pam_limits.so<br>-session optional pam_systemd.so<br>
session optional pam_oddjob_mkhomedir.so<br>session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid<br>session required pam_unix.so<br>session optional pam_sss.so<br>
<br></div><div>And GDM password config file includes the above:<br><br># cat /etc/pam.d/gdm-password <br>auth [success=done ignore=ignore default=bad] pam_selinux_permit.so<br>auth substack password-auth<br>
auth optional pam_gnome_keyring.so<br>auth include postlogin<br><br>account required pam_nologin.so<br>account include password-auth<br><br>password include password-auth<br>
<br>session required pam_selinux.so close<br>session required pam_loginuid.so<br>session optional pam_console.so<br>-session optional pam_ck_connector.so<br>session required pam_selinux.so open<br>
session optional pam_keyinit.so force revoke<br>session required pam_namespace.so<br>session include password-auth<br>session optional pam_gnome_keyring.so auto_start<br>session include postlogin<br>
<br></div><div>I don't know where to look further in troubleshooting domain logons. I kind of hope it is some obvious misconfiguration in my sssd.conf which I posted before. Many thanks for looking at this,<br><br></div>
<div>Roberts<br></div><div><br></div><div><br></div></div><div class="gmail_extra"><div><div class="h5"><br><br><div class="gmail_quote">On 24 October 2013 14:01, Roberts Klotiņš <span dir="ltr"><<a href="mailto:roberts.klotins@gmail.com" target="_blank">roberts.klotins@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div><div><div><div>Hi Thanks a lot for looking into this.<br><br></div>As you suspected - there is something that enterprise simple login added into the config file file:<br>
<br>[sssd]<br>services = nss, pam<br>
config_file_version = 2<br>
domains = PEOPLE<br><br>[nss]<br>filter_users = root<br>filter_groups = root<br><br>[pam]<br><br>[domain/PEOPLE]<br>description = PEOPLE AD domain<br>id_provider = ad<br>auth_provider = ad<br>access_provider = ad<br>chpass_provider = ad<br>
<br>ad_server = srv1.people.local<br>ad_hostname = client1.people.local<br>ad_domain = PEOPLE.LOCAL<br>case_sensitive = false<br><br>enumerate = true<br>cache_credentials = true<br>simple_allow_users = usr1, usr2<br><br>
</div>However when I deleted the last line in this file I got the same result.<br></div>/var/log/secure<br>datet:42:54 robbie gdm-password]: pam_unix(gdm-password:auth): authentication failure; logname=(unknown) uid=0 euid=0 tty=:1 ruser<br>
= rhost= user=PEOPLE\usr2<br>datet:42:54 robbie gdm-password]: pam_sss(gdm-password:auth): authentication failure; logname=(unknown) uid=0 euid=0 tty=:1 ruser=<br> rhost= user=PEOPLE\usr2<br>datet:42:54 robbie gdm-password]: pam_sss(gdm-password:auth): received for user PEOPLE\usr2: 6 (Permission denied)<br>
datet:42:59 robbie gdm-password]: pam_unix(gdm-password:auth): conversation failed<br>datet:42:59 robbie gdm-password]: pam_unix(gdm-password:auth): auth could not identify password for [PEOPLE\usr2]<br>datet:42:59 robbie gdm-password]: pam_sss(gdm-password:auth): authentication failure; logname=(unknown) uid=0 euid=0 tty=:1 ruser=<br>
rhost= user=PEOPLE\usr2<br>datet:42:59 robbie gdm-password]: pam_sss(gdm-password:auth): received for user PEOPLE\usr2: 7 (Authentication failure)<br><br></div>It appears I may need to configure something in pam, but maybe that is not the case??<br>
<br></div>Your help is much appreciated.<br><br></div>Roberts<br><div><div><div><div><br><div><br>
</div></div></div></div></div></div><div class="gmail_extra"><div><div><br><br><div class="gmail_quote">On 24 October 2013 13:00, <span dir="ltr"><<a href="mailto:sssd-users-request@lists.fedorahosted.org" target="_blank">sssd-users-request@lists.fedorahosted.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Send sssd-users mailing list submissions to<br>
<a href="mailto:sssd-users@lists.fedorahosted.org" target="_blank">sssd-users@lists.fedorahosted.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/sssd-users" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/sssd-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:sssd-users-request@lists.fedorahosted.org" target="_blank">sssd-users-request@lists.fedorahosted.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:sssd-users-owner@lists.fedorahosted.org" target="_blank">sssd-users-owner@lists.fedorahosted.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of sssd-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. GDM login (Roberts Klotiņš)<br>
2. Re: GDM login (Jakub Hrozek)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Thu, 24 Oct 2013 09:59:50 +0100<br>
From: Roberts Klotiņš <<a href="mailto:roberts.klotins@gmail.com" target="_blank">roberts.klotins@gmail.com</a>><br>
To: <a href="mailto:sssd-users@lists.fedorahosted.org" target="_blank">sssd-users@lists.fedorahosted.org</a><br>
Subject: [SSSD-users] GDM login<br>
Message-ID:<br>
<<a href="mailto:CALr2nHs9s41VbMVECCLrUQx1mfJYgsQFcLAxzT-0QzudHuaW8g@mail.gmail.com" target="_blank">CALr2nHs9s41VbMVECCLrUQx1mfJYgsQFcLAxzT-0QzudHuaW8g@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
Hello,<br>
<br>
After 2 days of reading on Samba4 SSSD and AD login I am running into<br>
problems. I have set up<br>
- AD server with Samba 4.2 (CentOS 6.3) - domain PEOPLE.LOCAL<br>
- Fedora 19 machine<br>
- Windows XP machine joined the domain without problems, I can run<br>
dsa.msc successfully<br>
<br>
I want to achieve AD user login from gdm. I understand that I should create<br>
used with dsa.msc and then I don't know if I should add it through Fedora<br>
19 user control panel. I tried it anyhow (was useful in debugging) but<br>
changes do not persist.<br>
<br>
I set up sssd (ver 1.11.1) it seems alright with AD options:<br>
- id and getent work for passwords and groups<br>
<br>
In my sssd.conf I have specified domain as [domain\PEOPLE]<br>
as all the correct server addresses etc are given there and it is easier to<br>
refer to the domain just by one name.<br>
sssd loads fine, getent passwd 'PEOPLE\user' works<br>
<br>
- realm discover gives this result<br>
realm discover --verbose PEOPLE.LOCAL<br>
* Resolving: _ldap._tcp.people.local<br>
* Performing LDAP DSE lookup on: 192.168.1.74<br>
! Received invalid or unsupported Netlogon data from server<br>
people.local<br>
type: kerberos<br>
realm-name: PEOPLE.LOCAL<br>
domain-name: people.local<br>
configured: no<br>
<br>
I can add previously defined domain user via Settings - User : Enterprise<br>
with correct username and password, however this does not persist - if I<br>
close the user admin panel and then re-open it, the added user is gone.<br>
<br>
If I try to log on from GDM (user not listed so I use PEOPLE\user) I get<br>
authentication failure<br>
/var/log/secure gives these messages:<br>
<br>
date:00:19 host gdm-password]: pam_unix(gdm-password:auth): authentication<br>
failure; logname=(unknown) uid=0 euid=0 tty=:0 ruser= rhost=<br>
user=PEOPLE\usr1<br>
date:00:19 host gdm-password]: pam_sss(gdm-password:auth): authentication<br>
failure; logname=(unknown) uid=0 euid=0 tty=:0 ruser= rhost=<br>
user=PEOPLE\usr1<br>
date:00:19 host gdm-password]: pam_sss(gdm-password:auth): received for<br>
user PEOPLE\usr1: 6 (Permission denied)<br>
date:00:48 host gdm-password]: pam_unix(gdm-password:auth): authentication<br>
failure; logname=(unknown) uid=0 euid=0 tty=:0 ruser= rhost=<br>
user=PEOPLE\usr1<br>
date:00:48 host gdm-password]: pam_sss(gdm-password:auth): authentication<br>
failure; logname=(unknown) uid=0 euid=0 tty=:0 ruser= rhost=<br>
user=PEOPLE\usr1<br>
date:00:48 host gdm-password]: pam_sss(gdm-password:auth): received for<br>
user PEOPLE\usr1: 6 (Permission denied)<br>
date:01:40 host gdm-password]: pam_unix(gdm-password:auth): authentication<br>
failure; logname=(unknown) uid=0 euid=0 tty=:0 ruser= rhost=<br>
user=PEOPLE\usr2<br>
date:01:40 host gdm-password]: pam_sss(gdm-password:auth): authentication<br>
failure; logname=(unknown) uid=0 euid=0 tty=:0 ruser= rhost=<br>
user=PEOPLE\usr2<br>
date:01:40 host gdm-password]: pam_sss(gdm-password:auth): received for<br>
user PEOPLE\usr2: 6 (Permission denied)<br>
date:01:46 host gdm-password]: pam_unix(gdm-password:auth): conversation<br>
failed<br>
date:01:46 host gdm-password]: pam_unix(gdm-password:auth): auth could not<br>
identify password for [PEOPLE\usr2]<br>
date:01:46 host gdm-password]: pam_sss(gdm-password:auth): authentication<br>
failure; logname=(unknown) uid=0 euid=0 tty=:0 ruser= rhost=<br>
user=PEOPLE\usr2<br>
date:01:46 host gdm-password]: pam_sss(gdm-password:auth): received for<br>
user PEOPLE\usr2: 7 (Authentication failure)<br>
date:01:46 host gdm-password]: gkr-pam: no password is available for user<br>
<br>
Could someone point me in the right direction as to what is wrong with my<br>
setup. I have sorted some problems out by myself, but here I feel out of<br>
depth.<br>
<br>
Many thanks,<br>
<br>
Roberts<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20131024/d09de109/attachment-0001.html" target="_blank">https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20131024/d09de109/attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Thu, 24 Oct 2013 12:01:11 +0200<br>
From: Jakub Hrozek <<a href="mailto:jhrozek@redhat.com" target="_blank">jhrozek@redhat.com</a>><br>
To: <a href="mailto:sssd-users@lists.fedorahosted.org" target="_blank">sssd-users@lists.fedorahosted.org</a><br>
Subject: Re: [SSSD-users] GDM login<br>
Message-ID: <<a href="mailto:20131024100111.GD4240@hendrix.redhat.com" target="_blank">20131024100111.GD4240@hendrix.redhat.com</a>><br>
Content-Type: text/plain; charset=utf-8<br>
<br>
On Thu, Oct 24, 2013 at 09:59:50AM +0100, Roberts Klotiņš wrote:<br>
> Hello,<br>
><br>
> After 2 days of reading on Samba4 SSSD and AD login I am running into<br>
> problems. I have set up<br>
> - AD server with Samba 4.2 (CentOS 6.3) - domain PEOPLE.LOCAL<br>
> - Fedora 19 machine<br>
> - Windows XP machine joined the domain without problems, I can run<br>
> dsa.msc successfully<br>
><br>
> I want to achieve AD user login from gdm. I understand that I should create<br>
> used with dsa.msc and then I don't know if I should add it through Fedora<br>
> 19 user control panel. I tried it anyhow (was useful in debugging) but<br>
> changes do not persist.<br>
><br>
> I set up sssd (ver 1.11.1) it seems alright with AD options:<br>
> - id and getent work for passwords and groups<br>
><br>
> In my sssd.conf I have specified domain as [domain\PEOPLE]<br>
> as all the correct server addresses etc are given there and it is easier to<br>
> refer to the domain just by one name.<br>
> sssd loads fine, getent passwd 'PEOPLE\user' works<br>
><br>
> - realm discover gives this result<br>
> realm discover --verbose PEOPLE.LOCAL<br>
> * Resolving: _ldap._tcp.people.local<br>
> * Performing LDAP DSE lookup on: 192.168.1.74<br>
> ! Received invalid or unsupported Netlogon data from server<br>
> people.local<br>
<br>
^^^ This is a Samba bug. I've seen it reported by another user, but I'm<br>
not sure if it's reported to Samba upstream.<br>
<br>
> type: kerberos<br>
> realm-name: PEOPLE.LOCAL<br>
> domain-name: people.local<br>
> configured: no<br>
><br>
> I can add previously defined domain user via Settings - User : Enterprise<br>
> with correct username and password, however this does not persist - if I<br>
> close the user admin panel and then re-open it, the added user is gone.<br>
<br>
This sounds like Enterprise Logins bug, but let's resolve the Permission<br>
Denied first.<br>
<br>
><br>
> If I try to log on from GDM (user not listed so I use PEOPLE\user) I get<br>
> authentication failure<br>
> /var/log/secure gives these messages:<br>
><br>
> date:00:19 host gdm-password]: pam_unix(gdm-password:auth): authentication<br>
> failure; logname=(unknown) uid=0 euid=0 tty=:0 ruser= rhost=<br>
> user=PEOPLE\usr1<br>
> date:00:19 host gdm-password]: pam_sss(gdm-password:auth): authentication<br>
> failure; logname=(unknown) uid=0 euid=0 tty=:0 ruser= rhost=<br>
> user=PEOPLE\usr1<br>
> date:00:19 host gdm-password]: pam_sss(gdm-password:auth): received for<br>
> user PEOPLE\usr1: 6 (Permission denied)<br>
> date:00:48 host gdm-password]: pam_unix(gdm-password:auth): authentication<br>
> failure; logname=(unknown) uid=0 euid=0 tty=:0 ruser= rhost=<br>
> user=PEOPLE\usr1<br>
> date:00:48 host gdm-password]: pam_sss(gdm-password:auth): authentication<br>
> failure; logname=(unknown) uid=0 euid=0 tty=:0 ruser= rhost=<br>
> user=PEOPLE\usr1<br>
> date:00:48 host gdm-password]: pam_sss(gdm-password:auth): received for<br>
> user PEOPLE\usr1: 6 (Permission denied)<br>
> date:01:40 host gdm-password]: pam_unix(gdm-password:auth): authentication<br>
> failure; logname=(unknown) uid=0 euid=0 tty=:0 ruser= rhost=<br>
> user=PEOPLE\usr2<br>
> date:01:40 host gdm-password]: pam_sss(gdm-password:auth): authentication<br>
> failure; logname=(unknown) uid=0 euid=0 tty=:0 ruser= rhost=<br>
> user=PEOPLE\usr2<br>
> date:01:40 host gdm-password]: pam_sss(gdm-password:auth): received for<br>
> user PEOPLE\usr2: 6 (Permission denied)<br>
> date:01:46 host gdm-password]: pam_unix(gdm-password:auth): conversation<br>
> failed<br>
> date:01:46 host gdm-password]: pam_unix(gdm-password:auth): auth could not<br>
> identify password for [PEOPLE\usr2]<br>
> date:01:46 host gdm-password]: pam_sss(gdm-password:auth): authentication<br>
> failure; logname=(unknown) uid=0 euid=0 tty=:0 ruser= rhost=<br>
> user=PEOPLE\usr2<br>
> date:01:46 host gdm-password]: pam_sss(gdm-password:auth): received for<br>
> user PEOPLE\usr2: 7 (Authentication failure)<br>
> date:01:46 host gdm-password]: gkr-pam: no password is available for user<br>
><br>
> Could someone point me in the right direction as to what is wrong with my<br>
> setup. I have sorted some problems out by myself, but here I feel out of<br>
> depth.<br>
><br>
> Many thanks,<br>
><br>
> Roberts<br>
<br>
Can you attach your sssd.conf? I suspect that realmd/enterprise logins<br>
set up the simple access provider and the user is not included in the<br>
<br>
<br>
------------------------------<br>
<br>
_______________________________________________<br>
sssd-users mailing list<br>
<a href="mailto:sssd-users@lists.fedorahosted.org" target="_blank">sssd-users@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/sssd-users" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/sssd-users</a><br>
<br>
<br>
End of sssd-users Digest, Vol 18, Issue 25<br>
******************************************<br>
</blockquote></div><br><br clear="all"><br></div></div><span><font color="#888888">-- <br>==<br>Roberts Klotins<br><br>
</font></span></div>
</blockquote></div><br><br clear="all"><br></div></div><span class="HOEnZb"><font color="#888888">-- <br>==<br>Roberts Klotins<br><br>
</font></span></div>
</blockquote></div><br><br clear="all"><br>-- <br>==<br>Roberts Klotins<br><br>
</div>