[Samba] WinBind and gdm/login

[Brett Hales]

On Thu, 2003-06-19 at 09:02, Patrick Gunerud wrote:
> The only way I could get it to work was to have the following gdm pam 
> config:
> 
Excellent - I have successfully logged into GDM using W2K ADS.

Thanks for the assistance.

Brett Hales

> #%PAM-1.0
> auth       required    pam_env.so
> auth       sufficient   pam_winbind.so
> auth       sufficient   pam_unix.so use_first_pass
> auth       required    pam_stack.so service=system-auth
> auth       required    pam_nologin.so
> account    sufficient   pam_winbind.so
> account    required    pam_stack.so service=system-auth
> password   required    pam_stack.so service=system-auth
> session    required     pam_mkhomedir.so skel=/etc/skel/ umask=0022
> session    required    pam_stack.so service=system-auth
> session    optional     pam_console.so
> 
> That will allow gdm to authenticate the user, but it will not allow 
> usernames with a + or \ separator so the way around that is to set the 
> following option:
> 
> winbind use default domain = yes
> 
> that will allow loging in with just the username.  The only problem 
> occurs when you have a user from another domain that needs to login.
> 
> Patrick
> 
> 
> Brett Hales wrote:
> 
> >Hi,
> >
> >I am currently trying to set up a RedHat 9 Linux client to authenticate
> >against a Windows 2000 Active Directory server.
> >
> >Using the Winbind documentation I have successfully authenticated
> >however I now have a problem with gdm.
> >
> >Jun 18 12:18:48 jerry pam_winbind[1192]: user 'AU+Bhales' granted acces
> >Jun 18 12:18:48 jerry pam_winbind[1192]: user 'AU+Bhales' granted acces
> >Jun 18 12:18:49 jerry gdm(pam_unix)[1192]: session opened for user
> >AU+Bhales by (uid=0)
> >Jun 18 12:18:49 jerry gdm[1202]: gdm_slave_session_start: User not
> >allowed to log in
> >
> >Does anybody know why gdm_slave_session_start is not allowing me to
> >login when pam_winbind has already authenticated me?
> >
> >Thanks,
> >
> >  
> >
-- 
Brett Hales <brett.hales at baesystems.com>