>If that works it means that you are not using SSSD on RHEL5 clients. >Please check your nsswitch and pam.conf to see what modules are actually >used.
Hmm. /etc/nsswitch.conf contains: -------------------------- passwd: files sss ldap shadow: files sss ldap group: files sss ldap -------------------------- And /etc/pam.d/system-auth contains: -------------------------- auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_sss.so use_first_pass auth sufficient pam_ldap.so use_first_pass auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password sufficient pam_ldap.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so session optional pam_ldap.so -------------------------- i.e. they both contain both sss and ldap, with sss first. The client was installed with the script generated by running "ipa-advise config-redhat-sssd-before-1-9" on the server. This script contains: # Use the authconfig to configure nsswitch.conf and the PAM stack authconfig --updateall --enablesssd --enablesssdauth and it also updates the /etc/sssd/sssd.conf file: So why would client not be using sssd? >Which RHEL5 versions do you use? >If memory does not fail me if you have SSSD 1.5 (I think it was starting 5.8) >you should be able to use ipa-client-install to configure sssd and pass the >list >of the servers in the --server option. Most of them are RHEL 5.11 with sssd 1.5.1. I'll try reinstalling and passing the list of servers with the --server option. David Guertin -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project