[ILUG] Single Sign On and Active Directory

[David Dorgan]

> At login we get the following message.
> "Authentication service cannot retrieve authentication info"
> 

First off, add 

shadow:	compat ldap

Is nss_ldap setup for nss_base_shadow?

If you ever have a probelm with PAM, basically
put debug every all of those entries. pam_unix.so debug etc..

Also add:

account     optional      pam_krb5.so debug
and
password    sufficient    pam_krb5.so debug
and
session     optional      pam_krb5.so debug

After this, I would suggest you strace -p
it in action, you'll see the pid in syslog,
if you have the debug options on. Also,
if you did want it for wait for a bit, so you
could look and see what it was doing,
plug out the network (but don't bring down the
card) so it'll spend lots of time doing
networking things.

Also, if you are unsure of what is being checked
you could run ethereal and see what is being
checked remotely.

There are some good resources on the subject in general:

http://www.ofb.net/~jheiss/krbldap/howto.html
http://www.metaconsultancy.com/whitepapers/ldap-linux.htm
http://kirby.hpcmp.hpc.mil/docs/krb-faq.html
http://www.padl.com/~lukeh/rfc2307bis.txt
http://www.mandrakesecure.net/en/docs/ldap-auth.php

David