try_disauth_first PAM setting is not working (4277076)

try_disauth_first PAM setting is not working

The try_disauth_first setting has been added to the PAM configuration for an application in order to reduce AD queries, however all queries from the application are still going directly through AD.

The try_disauth_first setting needs root access in order to work. If the application which is performing the authentication is not running as root then the option will be ignored.

The application performing authentication can be made to run as root by setting the binary to setuid on execute. This can be done with the following command (chmod u+s FILE).

More information about the try_disauth_first setting from the pam_vas manpage: try_disauth_first Set this option to try disauth first if the user has a disauth entry and gives the correct password for it. This setting is intended for applications that have a service account heavily log into the application with a password ( same account, multiple times a second ). Any login that happens though this setting will not receive a credential cache because no AD authentication happened. If the user does not have a disauth entry, or the hash doesnât match, the authentication is sent to AD as normal. The following features are not compatible with the try_disauth_first option if it is utilized due to the fact that no authentication takes place: the tcb_merge option, password expiration warnings, and nested group support.