What does the pam_winbind module do in the session phase? I suppose the session phase was originally missing and that was the reason to not add it there. But if it supports the session phase we can certainly add it.

Currently, the automatic homedirectory creation (if enabled, see man pam_winbind) of remote accounts is dealt with in the the pam_winbind (optional) session block. Not sure how automatic homedirectory creation for AD accounts is dealt with in general in authconfig.

Looks like you added it, but it doesn't get *invoked* for me. In further answer to your question about what it does: it also returns PAM_NEW_AUTHTOK_REQD when appropriate, and triggers a password change.

In Fedora 19 my {password,system}-auth PAM config files look like this:

account     required	  pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 1000 quiet
account     [default=bad success=ok user_unknown=ignore] pam_winbind.so cached_login
account     required	  pam_permit.so

I assume pam_localuser.so is succeeding in my case. I am not using the NSS provisions of winbind since they're too slow; it's only being used for *authentication*.

You must use --disablelocauthorize then.

Thanks. That *kind* of works. I had enabled sssd auth too, just to compare and see if it suffered the same problem. Now I add --disablelocauthorize and can't log in any more. My account stack looks like this:
account     required      pam_unix.so broken_shadow
account     sufficient    pam_succeed_if.so uid < 1000 quiet
account     [default=bad success=ok user_unknown=ignore] pam_sss.so
account     [default=bad success=ok user_unknown=ignore] pam_winbind.so cached_login
account     required      pam_permit.so

Since SSSD is not configured, I'd expect a 'user_unknown' response and for things to work properly? But I actually get:

Sep 12 10:38:02 dwoodhou-mobl3 sshd[6420]: fatal: Access denied for user  dwoodhou by PAM account configuration [preauth]

If I just comment out the pam_sss.so line from the *account* stack, I can log in again. Perhaps this is a pam_sss bug, not returning the correct result?

Perhaps pam_sss returns authinfo_unavail if it is misconfigured.