Return
-
Title
try_disauth_first PAM setting is not working -
Description
The try_disauth_first setting has been added to the PAM configuration for an application in order to reduce AD queries, however all queries from the application are still going directly through AD.
-
Cause
The try_disauth_first setting needs root access in order to work. If the application which is performing the authentication is not running as root then the option will be ignored. -
Resolution
The application performing authentication can be made to run as root by setting the binary to setuid on execute. This can be done with the following command (chmod u+s FILE). -
Additional Information
More information about the try_disauth_first setting from the pam_vas manpage: try_disauth_first Set this option to try disauth first if the user has a disauth entry and gives the correct password for it. This setting is intended for applications that have a service account heavily log into the application with a password ( same account, multiple times a second ). Any login that happens though this setting will not receive a credential cache because no AD authentication happened. If the user does not have a disauth entry, or the hash doesnât match, the authentication is sent to AD as normal. The following features are not compatible with the try_disauth_first option if it is utilized due to the fact that no authentication takes place: the tcb_merge option, password expiration warnings, and nested group support.