Bug 552542

Summary:	authconfig does not add broken_shadow parameter with SSSD
Product:	[Fedora] Fedora	Reporter:	Marko Myllynen <myllynen>
Component:	authconfig	Assignee:	Tomas Mraz <tmraz>
Status:	CLOSED NOTABUG	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	12	CC:	sgallagh, tmraz
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-01-13 17:28:26 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Marko Myllynen 2010-01-05 13:18:23 UTC

Description of problem:
When configuring system authentication with authconfig-6.0.0-2 on Fedora 12 and using SSSD for remote authentication the "broken_shadow" parameter is missing:

account    required     pam_unix.so

This won't let any users authenticated via SSSD in, one needs to have:

account    required     pam_unix.so broken_shadow

After adding the parameter remotely authenticated users can log in.

Comment 1 Tomas Mraz 2010-01-05 13:41:14 UTC

That might actually mean that there is a bug in nss_sss module. What idendtity provider do you have configured and what 'getent passwd <username-provided-by-sssd>' prints?

Comment 2 Stephen Gallagher 2010-01-05 14:06:46 UTC

I for one have an LDAP identity provider:

getent passwd sgallagh
sgallagh:*:13041:13041::/home/bos/sgallagh:/bin/bash

Comment 3 Tomas Mraz 2010-01-05 14:38:40 UTC

Stephen but for such passwd entry the pam_unix module should never require the broken_shadow option. Does it really not work for you without the option?

Comment 4 Marko Myllynen 2010-01-05 14:51:32 UTC

I think there was a bit confusion while testing with sssd-0.7 and later versions. 

With sssd-0.7 one gets :x: but with sssd-1.0 one gets :*:. So if broken_shadow is not needed with :*: then this is should not be an issue with latest sssd versions. (Unfortunately I cannot verify this at the moment due to other issues.)

Comment 5 Tomas Mraz 2010-01-05 15:12:16 UTC

OK, so please verify that it works fine as soon as you are able to do it.
I'll leave the bug open for now.

Comment 6 Marko Myllynen 2010-01-13 17:28:26 UTC

I can now confirm that with 1.0 one gets :*: and also that the broken_shadow parameter is unneeded for pam_unix.so (ie, authconfig does the right thing).

Closing, not really an issue.