Below are my config files:
/etc/pam.d/system-auth
#%PAM-1.0
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_succeed_if.so uid < 500 quiet
account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3
password sufficient pam_unix.so md5 shadow nullok try_first_pass
use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond
quiet use_uid
session required pam_unix.so
-----------------------------------------------------------
/etc/ldap.conf
# Host to connect to
host 10.100.223.63
#port 389
port 636
debug 0
logdir /var/log/pam_ldap
base dc=ldaptest,dc=local
ldap_version 3
#binddn bind@xxxxxxxxxxxxxx
# The credentials to bind with.
# Optional: default is no credential.
#bindpw testing
scope sub
timelimit 6
bind_timelimit 3
idle_timeout 90
#
# nss_ldap configuration parameter
bind_policy soft
# RFC 2307 (AD) mappings
#nss_map_objectclass posixAccount user
#nss_map_objectclass posixGroup group
#nss_map_objectclass account user
#nss_map_attribute uid sAMAccountName
#nss_map_attribute homeDirectory unixHomeDirectory
#nss_map_attribute userPassword unixUserPassword
#nss_map_attribute shadowLastChange pwdLastSet
#nss_map_attribute uniqueMember member
#nss_map_attribute gecos cn
pam_login_attribute uid
pam_lookup_policy yes
# Access controls via ldap
#
# Default is no; if set to yes, and user has no
# value for the host attribute, and pam_ldap is
# configured for account management (authorization)
# then the user will not be allowed to login.
#pam_check_host_attr no
#pam_check_service_attr no
#pam_min_uid 1000
# Do not hash the password at all, assume the directory is doing this
pam_password ad
# nss_ldap configurations
nss_base_passwd cn=users,dc=ldaptest,dc=local?sub
nss_base_shadow
cn=users,dc=ldaptest,dc=local?sub?&(objectCategory=users)(uidnumber=*)
nss_base_group
cn=groups,dc=ldaptest,dc=local?sub?&(objectCategory=group)(gidnumber=*)
#ssl no
# openldap SSL bits
ssl start_tls
tls_cacertfile /etc/openldap/certs/cert.crt
tls_ciphers HIGH
----------------------------------------------------------------------------
--------
SLAPD config:
include /usr/local/openldap/etc/openldap/schema/core.schema
include /usr/local/openldap/etc/openldap/schema/cosine.schema
include /usr/local/openldap/etc/openldap/schema/inetorgperson.schema
include /usr/local/openldap/etc/openldap/schema/nis.schema
loglevel 1 2 4 8 16 32 128 256 16384
password-hash {CRYPT}
pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args
TLSCipherSuite HIGH:+TLSv1:+SSLv2:+SSLv3
TLSCACertificateFile /usr/local/openldap/etc/openldap/certs/cert.crt
TLSCertificateFile /usr/local/openldap/etc/openldap/certs/cert.crt
TLSCertificateKeyFile /usr/local/openldap/etc/openldap/certs/cert.key
security ssf=1 update_ssf=128 simple_bind=128 update_tls=128 tls=128
database bdb
suffix "dc=ldaptest,dc=local"
rootdn "cn=manager,dc=ldaptest,dc=local"
rootpw {SSHA}uxhIdkPFWVYdBMaHg8m0O+5Y7cchdxnG
chase-referrals no
rebind-as-user yes
directory "/usr/local/openldap/var/openldap-data"
overlay rwm
rwm-map objectclass user posixAccount
rwm-map attribute sAMAccountname uid
rwm-map attribute givenName cn
rwm-map attribute unixHomeDirectory homeDirectory
rwm-map attribute unixUserPassword UserPassword
access to attrs=userPassword
by dn="cn=Bind User,cn=Users,dc=ldaptest,dc=local"
by self read
by * auth
access to * by * read
syncrepl rid=1
provider="ldaps://ldaptest.local:636"
type=refreshAndPersistant
interval="00:00:15:00"
retry="60 3 300 10"
searchbase="cn=Users,dc=ldaptest,dc=local"
filter="(&(objectClass=user)(samaccountname=*))"
scope="sub"
schemachecking="off"
bindmethod="simple"
binddn="cn=Bind User,cn=Users,dc=ldaptest,dc=local"
credentials="testing"
Thanks,
Lynn
-----Original Message-----
From: pam-list-bounces@xxxxxxxxxx [mailto:pam-list-bounces@xxxxxxxxxx] On
Behalf Of Kenneth Geisshirt
Sent: Saturday, September 20, 2008 4:19 AM
To: Pluggable Authentication Modules
Subject: Re: Authentication problems with ldap
Lynn York wrote:
> I am having some issue with PAM and authentication with an openldap
proxy
> to AD.
Please send your configuration files. Otherwise it is a bit hard to help
you.
/kneth
_______________________________________________
Pam-list mailing list
Pam-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/pam-list
Attachment:
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ Pam-list mailing list Pam-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/pam-list
