#705568 libpam-ldapd: LDAP Authentication failure with cached credentials

Package:
libpam-ldapd
Source:
nss-pam-ldapd
Description:
PAM module for using LDAP as an authentication service
Submitter:
Jonatan Åkerlind
Date:
2015-04-16 20:48:10 UTC
Severity:
normal
#705568#5
Date:
2013-04-16 21:19:11 UTC
From:
To:
Dear Maintainer,

the current pam configuration in wheezy up to experimental for libpam-ldapd does not allow a login using cached credentials (libpam-ccreds). The problem area seems to be the "account" pam type where the current configuration puts the ldap module as an Additional.

I see this behaviour using the currently available config when doing a login without LDAP reachable:

You have been logged on using cached credentials.

Authentication failure


By reordering the ldap as a Primary for account and also allowing it to pass if authinfo_unavail (i.e. no LDAP servers reachable) it works as expected for me. This solution is briefly touched in this Ubuntu forum thread: http://ubuntuforums.org/showthread.php?t=1585654 .

My setup is simple with only passwd, group and credentials in LDAP doing auth with libpam-ldapd and caching with libpam-ccreds.
#705568#10
Date:
2013-04-16 21:29:43 UTC
From:
To:
Just found this bug report which seems to be related
#705568#15
Date:
2013-05-03 12:15:37 UTC
From:
To:
The problem with moving LDAP to Primary would mean that if pam_unix
allows access, pam_ldap will no longer be consulted. This means that
extra LDAP authorisation checks will be skipped (e.g. the
pam_authz_search option in nslcd.conf or password expiration checks in
slapd).

A little background on the complexities of the authorisation stack is in
#583492.

Can you provide some more information on what happens when the
authorisation fails in your PAM stack (add debug to both pam_unix and
pam_ldap in common-account)?

Thanks,
#705568#24
Date:
2015-04-15 17:13:38 UTC
From:
To:
found 705568 0.9.4-3
quit

  In 0.9.4-3 revision, Account-Type is Primary, so I applied your
  changes for the Account: entry, yet neither local nor LDAP users can
  login (even if LDAP server is reachable), and I found the following in
  /var/log/auth.log:

Apr 15 18:40:22 myhostname login[13808]: PAM pam_parse: expecting non-zero; [... new_authtok_reqd=done ignore=ignore user_unknown=ignore authinfo_unavail=0 default=bad]
#705568#31
Date:
2015-04-16 20:46:05 UTC
From:
To:
authinfo_unavail=0 is not valid. You should probably specify
authinfo_unavail=ignore or something else depending on how you want your
PAM stack to look.

If you provide your full /etc/pam.d/common-account file, I can have a
look. Also, please clarify which changes you made to which file.

Thanks,