-
タイトル
Logon credentials for users who are not local or QAS enabled are not passed on to the next database defined in nsswitch.conf -
説明
Using RHEL System Security Services (SSS) as an example.
When /etc/nsswitch.conf is configured as follows
passwd: files vas4 sssLocal users can logon, QAS users can logon but SSS users cannot logon.
Users who are not local or QAS enabled but are SSS enabled are unable to authenticate. -
原因
When an SSS user attempts to authenticate and once QAS decides that they are not a QAS user it fails to pass them on to the next database listed in nsswitch.conf. -
対策
Resolution:
For QAS 4.0.3.x
Upgrade to QAS 4.0.3.151 of greater.
For QAS 4.1.x
Upgrade to QAS 4.1.21770
For both versions of QAS the following lines may have to be commented out in “password-auth-ac”
auth requisite pam_vas3.so echo_return
account requisite pam_vas3.so echo_return
password requisite pam_vas3.so echo_return
session requisite pam_vas3.so echo_return
By having these commented out it allows the password to be passed on from QAS for SSS users otherwise the password would be removed from the stack preventing SSS enabled users from authenticating.Workaround:
Change the order in /etc/nsswitch.conf for the database search by putting VAS4 last
passwd: files sss vas4Local users can logon, SSS users can logon and QAS users can logon.