Changes between Version 5 and Version 6 of PrincetonLDAPAuthentication6

Timestamp:

Jan 7, 2013 10:40:37 AM (13 years ago)

Author:

brose

Comment:

--

PrincetonLDAPAuthentication6

@@ -34 +34 @@
 }}}
 
+You will also need to make sure to use this SSSD configuration in PAM. Update /etc/nsswitch.conf accordingly:
+{{{
+passwd:     files sss
+shadow:     files sss
+group:      files sss
+netgroup:   files sss
+}}}
+
+Also, update /etc/pam.d/system-auth-ac and password-auth-ac to include references to sss:
+{{{
+#%PAM-1.0
+# This file is auto-generated.
+# User changes will be destroyed the next time authconfig is run.
+auth        required      pam_env.so
+auth        sufficient    pam_unix.so nullok try_first_pass
+auth        requisite     pam_succeed_if.so uid >= 100 quiet
+auth        sufficient    pam_sss.so use_first_pass
+auth        required      pam_deny.so
+
+account     required      pam_unix.so broken_shadow
+account     sufficient    pam_localuser.so
+account     sufficient    pam_succeed_if.so uid < 100 quiet
+account     [default=bad success=ok user_unknown=ignore] pam_sss.so
+account     required      pam_permit.so
+
+password    requisite     pam_cracklib.so try_first_pass retry=3 type=
+password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
+password    sufficient    pam_sss.so use_authtok
+password    required      pam_deny.so
+
+session     optional      pam_keyinit.so revoke
+session     required      pam_limits.so
+session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
+session     required      pam_unix.so
+session     optional      pam_sss.so
+}}}
 
 Someone else once wrote this, but it no longer seems relevant as it disables sssd: