lightdm does not show users which have no shadow password

Question

I have switched my virtual machine, to use a ldap server for authentication with sssd. I assumed with this setup I will not need to use local passwords anymore, as i can login with ldap authentication. But it seems that lightdm and it's background service accounts-daemon do not show users in the greeter, which do not have a shadow password set. If the shadow password is set, the user is shown in the user list in the greeter. If there is no shadow password the greeter doesn't show the user.

This seems to depends on the "accounts-daemon", which is used by lightdm to get its userlist.

 /usr/libexec/accounts-daemon --debug

shows that my user is skipped as long as the user doesn't have a shadow password

How can i make accounts-daemon show all users, which only happen to have not a shadowpassword. I do not like the idea to create "random" local passwords.

Or can I switch off accounts.daemon for lightdm?

Answer 1

After one day, i found finally out, that per default the user i create were "locked". There is a specific feature for passwd, which i never used before, to lock/unlock users. If you unlock the user with passwd -u -f USERNAME, actually the the passwd field in the shdadow file is modified from "!!" (locked) to "!"(unlocked, without passwd).

I found with my configuration no way to login without passwd, as then the sssd/ldap jumps in. But with this, having one "!" in the passwd field of shadow, accounts-daemon is happy.

Me too - but this was a high learning curve, for simply using ldap with two computers. I understand the logic that accounts-daemon "skips" locked accounts, but this should be somehow way more obvious.