I am trying to setup Kerberos MIT authentication with OpenLdap autorisation on Debian Jessie.
Authentication part is working great, as I can login to SSH using my kerberos account.
I even can create user home directory using pam_mkhomedir.so
However, I can't use Ldap posixGroup to allow access to my SSH server :
Here is the output of
getent group | grep tupac adminsLinux:*:3000:uid=tupac,ou=people,dc=maytacapac,dc=inc
Here is the extract of sshd_config :
Here are the log files :
sshd: User tupac from a.b.c.d not allowed because not in any group sshd: input_userauth_request: invalid user tupac [preauth] sshd: Connection closed by a.b.c.d [preauth]
id tupac output
uid=20003(tupac) gid=20003 groups=20003
tupac user is not part of any Unix group, but I want to allow access based on OpenLdap posixGroup. I have thought /etc/nsswitch.conf configuration and getent group resolution would be enough to grant access according to posixGroups.