<div dir="ltr">hi Lukas<div><br></div><div>the debugging tips is really helpfule trouble shooting, i got a lot error "pam_sss(sshd:auth): received for user nick: 9 (Authentication service cannot retrieve authentication info)"</div>
<div>it turned out that i used <a href="http://www.linuxquestions.org/questions/linux-enterprise-47/rhel-6-ldap-now-requires-tls-843917/#post4521478">ldap (without SSL) that sssd not support any more</a> for secure reason.<br>
after enable ssl for my openldap server, thinks work now</div><div><br></div><div>thanks very much</div></div><div class="gmail_extra"><br clear="all"><div> Thanks & Best Regards!<br><br> ///<br> (. .)<br>
--------ooO--(_)--Ooo--------<br> | Nick Tan |<br> ------------------------------------<br></div>
<br><br><div class="gmail_quote">On Sat, Jun 28, 2014 at 1:33 AM, Lukas Slebodnik <span dir="ltr"><<a href="mailto:lslebodn@redhat.com" target="_blank">lslebodn@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="">On (28/06/14 00:03), XuQing Tan wrote:<br>
>Hi folks<br>
><br>
>i setup sssd 1.9.2 on centos 6 x64<br>
>i can get the user info via 'id <user>'<br>
>i can su to that user as root (no password prompt since i'm root)<br>
><br>
>[root@nick-ldap ~]# su - nick<br>
>-sh-4.1$ exit<br>
>logout<br>
><br>
</div>root can swith to another user without any prompting password.<br>
(pam_sss was not involved)<br>
It is default behaviour.<br>
I am not pam expert, but it should be caused by next line in /etc/pam.d/su<br>
<br>
account sufficient pam_succeed_if.so uid = 0 use_uid quiet<br>
<div class=""><br>
>but i can't su to this user as non-root (with password prompt but get<br>
>incorrect password error)<br>
>[root@nick-ldap ~]# su - demo<br>
>[demo@nick-ldap ~]$ su - nick<br>
>Password:<br>
>su: incorrect password<br>
</div>There are two explanation:<br>
a) you used wrong password.<br>
b) there is some problem with sssd configuration.<br>
<br>
In second case, put "debug_level = 7" into pam and domain section in sssd.conf;<br>
restarts sssd; reproduce problem; and try to analyse log files in /var/log/sssd<br>
If you don't find root of problem please send sanitised log fail to the mailing<br>
list.<br>
<br>
LS<br>
_______________________________________________<br>
sssd-users mailing list<br>
<a href="mailto:sssd-users@lists.fedorahosted.org">sssd-users@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/sssd-users" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/sssd-users</a><br>
</blockquote></div><br></div>