Não é possível fazer o login com o KDM e o SSSD, mas o login funciona bem no console

Question

Eu tenho a autenticação LDAP configurada com o SSSD e consigo fazer o login por meio do console e do ssh. No entanto, quando tento fazer o login através do KDM, apenas diz falha de autenticação ... Mais especificamente:

Jan  9 10:29:11 adams20420 sssd[be[default]]: Failed to set LDAP SASL nocanon option to true. If your system is configured to use SASL, LDAP operations might fail.
Jan  9 10:29:24 adams20420 kdm: :1[4560]: PAM pam_parse: expecting return value; [...sufficeint]
Jan  9 10:29:24 adams20420 kdm: :1[4560]: PAM unable to dlopen(/lib64/security/pam_console.so): /lib64/security/pam_console.so: cannot open shared object file: No such file or directory
Jan  9 10:29:24 adams20420 kdm: :1[4560]: PAM adding faulty module: /lib64/security/pam_console.so
Jan  9 10:29:24 adams20420 kdm: :1[4560]: pam_ldap: ldap_starttls_s: Operations error
Jan  9 10:29:24 adams20420 kdm: :1[4560]: pam_unix(kde:auth): authentication failure; logname= uid=0 euid=0 tty=:1 ruser= rhost=  user=igierl1

Aqui está o pam.d / kdm

auth       required    pam_env.so
auth       substack    system-auth
account    required    pam_nologin.so
account    include     system-auth
password   include     system-auth
session    required    pam_loginuid.so
session    optional    pam_console.so
session    optional    pam_keyinit.so force revoke
session    required    pam_namespace.so
session    include     system-auth

system-auth:

auth            sufficient      pam_ldap.so
auth            required        pam_env.so
auth            required        pam_unix.so try_first_pass likeauth nullok
auth            optional        pam_permit.so

account         sufficient      pam_ldap.so
account         required        pam_unix.so
account         optional        pam_permit.so

password        sufficeint      pam_ldap.so
password        required        pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3
password        required        pam_unix.so try_first_pass use_authtok nullok sha512 shadow
password        optional        pam_permit.so

session         required        pam_limits.so
session         required        pam_env.so
session         required        pam_unix.so
session         optional        pam_ldap.so
session         optional        pam_permit.so

Informação adicional: Distribuição - Gentoo

As contas locais funcionam bem e fazem o login através do ldap via ssh e / ou consola. O único problema é fazer o login através do KDM. É quando o erro aparece.

ldap.conf

timelimit 120
bind_timelimit 120
idle_timelimit 3600

TLS_CACERTDIR /etc/openldap/cacerts
URI ldaps://hucsc2.hofstra.edu/
BASE dc=<sub>,dc=<domain>,dc=edu

# Just assume that there are no supplemental groups for these named users
nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd,gdm,polkituse$

ssl start_tls
TLS_CHECKPEER no
TLS_CRLCHECK none
TLS_REQCERT never
pam_password md5

nsswitch.conf

# /etc/nsswitch.conf:
# $Header: /var/cvsroot/gentoo/src/patchsets/glibc/extra/etc/nsswitch.conf,v 1.1 2006/09/29 23:52:23 vapier Exp $

passwd:      files sss
shadow:      files sss
group:       files sss

hosts:       files dns
networks:    files dns

services:    files sss
protocols:   files
rpc:         files
ethers:      files
netmasks:    files
netgroup:    files
bootparams:  nisplus [NOTFOUND=return]files
publickey:   nisplus
automount:   files ldap
aliases:     files nisplus

    

Answer 1

Foi respondida no serverfault:

link

Em suma, eu deveria usar pam_sss.so em vez de pam_ldap.so