I am trying to setup Kerberos MIT authentication with OpenLdap autorisation on Debian Jessie.
Authentication part is working great, as I can login to SSH using my kerberos account.
I even can create user home directory using pam_mkhomedir.so
However, I can't use Ldap posixGroup to allow access to my SSH server :
Here is the output of getent group
getent group | grep tupac
adminsLinux:*:3000:uid=tupac,ou=people,dc=maytacapac,dc=inc
Here is the extract of sshd_config :
AllowGroups adminsLinux
Here are the log files :
sshd[3305]: User tupac from a.b.c.d not allowed because not in any group
sshd[3305]: input_userauth_request: invalid user tupac [preauth]
sshd[3305]: Connection closed by a.b.c.d [preauth]
Here is id tupac
output
uid=20003(tupac) gid=20003 groups=20003
tupac user is not part of any Unix group, but I want to allow access based on OpenLdap posixGroup. I have thought /etc/nsswitch.conf configuration and getent group resolution would be enough to grant access according to posixGroups.