I've got this working on one virtual machine but must have missed recording something I installed or configured, as I can't get it working on any other machines that I create. I've been digging through Google and here, but most everything I find winds up having to do with displaying the "Other..." login field in the greeter, or getting FreeIPA to work properly in the first place.
Steps I take: I create a fresh install of Ubuntu/Mate 16.04, do all updates/upgrades, add the machine to FreeIPA, install freeipa-client, do the configs and run ipa-client-install, see that the new VM is enrolled properly in FreeIPA, and then test by ssh-ing into myself and some other machines with users that are only in FreeIPA. That all works fine-- I can see the various hosts without using FQDNs and use users that aren't in the local passwd file.
However, when I try to use the Mate GUI to switch users to a user in FreeIPA that can successfully log in via ssh (which will otherwise quickly fail and return me to the login screen, as the user doesn't yet have a home directory), I get the error "Incorrect password, please try again". The only user that can log in via this screen is the one that I defined locally. I've tried creating a home directory owned by a FreeIPA user just in case, but that makes no difference.
So ssh is resolving names that lightdm or some other component in the login process isn't. The lightdm log shows this for a user "student", a user only defined in FreeIPA:
[+6783.50s] DEBUG: Continue authentication [+6784.83s] DEBUG: Session pid=25854: Authentication complete with return value 0: Success [+6784.83s] DEBUG: Authenticate result for user student: Success [+6784.83s] DEBUG: User student authorized, but no account of that name exists [+6784.84s] DEBUG: Greeter start authentication for student [+6784.84s] DEBUG: Seat seat0: Failed to work out session ID to mark [+6784.84s] DEBUG: Session pid=25872: Started with service 'lightdm', username 'student' [+6784.84s] DEBUG: Session pid=25854: Exited with return value 0 [+6784.84s] DEBUG: Seat seat0: Session stopped [+6784.85s] DEBUG: Session pid=25872: Got 1 message(s) from PAM [+6784.85s] DEBUG: Prompt greeter with 1 message(s)
This is distinctly different from my Ubuntu/Mate machine where this is all working right; there, the log looks like:
[+50005.95s] DEBUG: Continue authentication [+50006.20s] DEBUG: Session pid=10425: Authentication complete with return value 0: Success [+50006.20s] DEBUG: Authenticate result for user student: Success [+50006.20s] DEBUG: User student authorized [+50006.20s] DEBUG: Greeter sets language en_GB [+50006.23s] DEBUG: Greeter requests session mate
During failure, the auth log shows this:
Aug 20 18:19:26 client2 lightdm: pam_unix(lightdm:auth): authentication failure; logname= uid=0 euid=0 tty=:1 ruser= rhost= user=student Aug 20 18:19:27 client2 lightdm: pam_sss(lightdm:auth): authentication success; logname= uid=0 euid=0 tty=:1 ruser= rhost= user=student Aug 20 18:19:27 client2 lightdm: PAM unable to dlopen(pam_kwallet.so): /lib/security/pam_kwallet.so: cannot open shared object file: No such file or directory Aug 20 18:19:27 client2 lightdm: PAM adding faulty module: pam_kwallet.so Aug 20 18:19:27 client2 lightdm: PAM unable to dlopen(pam_kwallet5.so): /lib/security/pam_kwallet5.so: cannot open shared object file: No such file or directory Aug 20 18:19:27 client2 lightdm: PAM adding faulty module: pam_kwallet5.so Aug 20 18:19:27 client2 lightdm: pam_succeed_if(lightdm:auth): requirement "user ingroup nopasswdlogin" not met by user "student"
I have some vague impression that I had to add some package that make sure that LDAP is contacted, but after lots of investigation this just hasn't revealed anything. I'm happy to have more pointers of things to look at or reconcile between my working and non-working system, but I'm kind of at a loss here.
This seemed a plausible cause, but I can't find any differences in /etc/pam.d that point to the error: https://stackoverflow.com/questions/14983807/ldap-login-works-via-terminal-but-doesnt-work-via-gui.
Does this ring any bells for anyone?