I'm attempting to set up LDAP authentication according to the instructions in Sander Van Vugt's RHCSA/RHCE book for RHEL7. In chapter 6 he explains that when using
FORCELEGACY option is set to
/etc/sysconfig/authconfig. This is supposed to configure
nslcd instead of
I do not see this happening. Perhaps it was that way in 7.0 or even 7.1, but in 7.3 the option is set to
no after using
If I put aside the
sssd confusion and attempt the complete the exercise which leads to running
su - lara to authenticate via LDAP to said user, I merely get:
su: user lara does not exist
I've verified that the FreeIPA server is answering queries using
ldapsearch and in doing so, confirmed that the user is in LDAP. It seems to me, though, that
su is not authenticating against LDAP, but instead
system-auth configuration includes the
sssd entries that seem to be necessary:
auth sufficient pam_sss.so forward_pass
account [default=bad success=ok user_unknown=ignore] pam.sss.so
password sufficient pam_sss.so use_authtok
session optional pam_sss.so
/etc/nsswitch.conf file contains:
passwd: files sss
shadow: files sss
group: files sss
sssd service is active.
There aren't any log entries in
/var/log/sssd/*. In fact, none of the
sssd logs contains anything.
After some reading I'm still no closer to a solution to this, however, I do have more information.
I am able to authenticate as user lara if I
ssh into the LDAP server. So I know that LDAP is actually working.
I also looked at the
PAM config for
su. This is pulling in the
auth substack system-auth
account include system-auth
password include system-auth
session include system-auth
so it should be making use of the
pam_sss.so module implicitly.
Still can't sort it out, though.
Being able to log into the IPA server either locally or via SSH with user lara, I decided to compare the pam files on it with those on the client. The only difference I was able to determine is that the client contained
broken_shadow with the
pam_unix.so account entry. I removed it and even rebooted but it didn't fix anything.
How do I disable
broken_shadow? I can't find anything about it.