Trouble with Kerberos/LDAP and AIX 6.1

[jeffgeiger]

The KRB5ALDAP compound load module is giving me fits. Everything looks like it should be working, but no.

Goal: Integrate AIX host with Active Directory using a KRB5ALDAP compound load module so that users can be created in AD and used in AIX, with unix attributes (registry values) being pulled from AD. Eliminate the need to manage user accounts on a per-server basis.

Issue: User attributes are visible with lsuser and returned with ldapsearch. Kerberos authentication shows successful at the domain controller, but a "permission denied" or "invalid login or password" message is displayed. Files can be chown-ed to the user accounts, but SU fails.

I attached a doc with the pertinent configs and troubleshooting steps. Since making that doc, I have also chased the enctype (switched to solely RC4) and the KVNO (tried 2, 3, 4). But no love.

 

[AIXLogician]

I see you are using LDAP as well. Kerberos + LDAP + AIX = 'hard nut to crack', its not that easy for the three to work together.

What I suggest is completely eliminate LDAP, meaning just use kerberos for Authentication and Authorization. See if you can get in to the system.

 

[jeffgeiger]

Got it!

2 small things:

1: The primary group of the AD user needed to be a group defined in AD.
(This fixed the su issue.)

2: Changed methods.cfg, added tgt_verify=no to the options.

KRB5A:
        program = /usr/lib/security/KRB5A
        program_64 = /usr/lib/security/KRB5A_64
        options = authonly,is_kadmind_compat=no,tgt_verify=no