Well just quickly looking at the Pam setup I only see the kerberos module no Ldap or sssd modules so authentication should be working but not authorization while is fine if there is a local user that matches but other wise it won't work.
That said if the palm file is incomplete and you do have one of the Ldap or sssd modules loaded then I would look at selinux the python policy tools are very helpful with debugging that

Sent from my BlackBerry - the most secure mobile device
From: deven...@redhat.com
Sent: October 4, 2017 7:54 PM
To: spacewalk-list@redhat.com
Reply-to: spacewalk-list@redhat.com
Subject: [Spacewalk-list] LDAP auth issues - spacewalk 2.4


Hello team, 

Couldnt find a Spacewalk distribution list hence sending to the Satellite mailing list. 

Need help on auth issues with Spacewalk 2.4.

Customer has a spacewalk server for managing package updates. Login to the UI using local admin and 'spacewadmin' user is successful. Login via LDAP account fails. 


==> /var/log/secure <==
Sep 27 12:06:40 spacewalk-server-01 java: pam_krb5[16775]: TGT verified
Sep 27 12:06:40 spacewalk-server-01 java: pam_krb5[16775]: authentication succeeds for 'd859112' (d859...@core.dir.telstra.com)
Sep 27 12:06:40 spacewalk-server-01 java: PAM audit_log_acct_message() failed: Permission denied

==> /var/log/messages <==
Sep 27 12:06:40 spacewalk-server-01 server: 2017-09-27 12:06:40,459 [ajp-bio-0:0:0:0:0:0:0:1-8009-exec-438] WARN  com.redhat.rhn.domain.user.legacy.UserImpl - PAM login for user User d859112 (id 26, org_id 5) failed with error System error.

As per my understanding, LDAP auth is set up correctly. 

The PAM module is as follows:
#%PAM-1.0
auth        required      pam_env.so
auth        sufficient    pam_krb5.so no_user_check
auth        required      pam_deny.so
account     required      pam_krb5.so no_user_check


The /etcrhn/rhn.conf is attached for reference. 

Looking for assistance on fixing this. 

Thank you all.  



--
Dev


_______________________________________________
Spacewalk-list mailing list
Spacewalk-list@redhat.com
https://www.redhat.com/mailman/listinfo/spacewalk-list

Reply via email to