Hide Forgot
Description of problem: When enabling Winbind and SSSD (or any other PAM module) and configuring Winbind to authenticate from an AD domain and SSSD from non-AD LDAP/Kerberos, pam_winbind.so prevents LDAP/Kerberos users logging in. In /etc/pam.d/system-auth generated by authconfig there is: account [default=bad success=ok user_unknown=ignore] pam_sss.so account [default=bad success=ok user_unknown=ignore] pam_winbind.so A user authenticated by Winbind is able to login as SSSD correctly ignores the user unknown to it but a user successfully authenticated by SSSD fails to login. If changing the above to account [default=bad success=ok user_unknown=ignore] pam_sss.so account [default=ignore success=ok user_unknown=ignore] pam_winbind.so then also SSSD authenticated users are able login but it might be better to change pam_winbind.so to honour the user_unknown=ignore parameter (as SSSD does). Version-Release number of selected component (if applicable): RHEL 6.2
This is interesting - surely pam_winbind should return user_unknown in this case. But also I'd like to know what is returned by pam_winbind.so currently in this situation. If the return value is PAM_IGNORE, authconfig should probably use account [default=bad success=ok ignore=ignore user_unknown=ignore] pam_sss.so
This request was evaluated by Red Hat Product Management for inclusion in a Red Hat Enterprise Linux maintenance release. Product Management has requested further review of this request by Red Hat Engineering, for potential inclusion in a Red Hat Enterprise Linux Update release for currently deployed products. This request is not yet committed for inclusion in an Update release.
This request was not resolved in time for the current release. Red Hat invites you to ask your support representative to propose this request, if still desired, for consideration in the next release of Red Hat Enterprise Linux.
This request was erroneously removed from consideration in Red Hat Enterprise Linux 6.4, which is currently under development. This request will be evaluated for inclusion in Red Hat Enterprise Linux 6.4.
I'm happy to confirm that the build samba-3.6.8-130.el6 fixes this issue, thanks!
Great! Thanks for verifying!
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2013-0338.html