<div dir="ltr">Found the problem. The users were added by a custom script that didn't prompt for passwords. As such, the user's were in IPA and enabled but not able to login as they never had a initial password set. So on migrated machines it fell through to winbind and somehow found the old AD server. </div>
<div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Jun 5, 2014 at 1:47 PM, Scott Allen <span dir="ltr"><<a href="mailto:sallen@theembassyvfx.com" target="_blank">sallen@theembassyvfx.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div dir="ltr" style="font-family:arial,sans-serif;font-size:13px">Hi, <div>I didn't migrate the passwords. All users started with a new default on IPA. </div>
<div>The new user foo doesn't exist on the AD system but can login successfully using IPA credentials on a migrated system.</div>
</div></div><div class="gmail_extra"><br><br><div class="gmail_quote"><div class="">On Fri, May 30, 2014 at 12:35 AM, Sumit Bose <span dir="ltr"><<a href="mailto:sbose@redhat.com" target="_blank">sbose@redhat.com</a>></span> wrote:<br>
</div><div><div class="h5"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div>On Thu, May 29, 2014 at 11:20:37AM -0700, Scott Allen wrote:<br>
> Hi,<br>
> Having a particularly weird problem. We have moved from AD to freeIPA<br>
> recently and while there have been some bumps, most of the CentOS 6.2 boxes<br>
> make the transition successfully. Some background.<br>
><br>
> The Linux boxes were joined to AD on Windows 2008R2 using samba/winbind.<br>
> When we moved from AD, boxes were not "removed" from AD, just disabled on<br>
> the server side. We scripted the necessary bits since we were moving to a<br>
> new subnet as well. The script runs "ipa-client-install -p admin --password<br>
> PASSWORD --enable-dns-updates -U"<br>
><br>
> The machines were joined successfully to freeIPA and then added to<br>
> allow_all_hosts Host Group.<br>
><br>
> On a workstation that was migrated, all users can successfully log in.<br>
> On a fresh install of CentOS6.2, only myself (admin_user) and a newly<br>
> created user (foo) can successfully log in.<br>
><br>
> On this fresh install, 'david' is blocked but new user 'foo' is allowed.<br>
><br>
> May 29 09:20:29 embassy419 polkitd(authority=local): Registered<br>
> Authentication Agent for session /org/freedesktop/ConsoleKit/Session1<br>
> (system bus name :1.26 [/usr/libexec/polkit-gnome-authentication-agent-1],<br>
> object path /org/gnome/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)<br>
> May 29 09:20:46 embassy419 pam: gdm-password[2910]:<br>
> pam_unix(gdm-password:auth): authentication failure; logname= uid=0 euid=0<br>
> tty=:0 ruser= rhost= user=david<br>
> May 29 09:20:47 embassy419 pam: gdm-password[2910]:<br>
> pam_sss(gdm-password:auth): system info: [Preauthentication failed]<br>
> May 29 09:20:47 embassy419 pam: gdm-password[2910]:<br>
> pam_sss(gdm-password:auth): authentication failure; logname= uid=0 euid=0<br>
> tty=:0 ruser= rhost= user=david<br>
> May 29 09:20:47 embassy419 pam: gdm-password[2910]:<br>
> pam_sss(gdm-password:auth): received for user david: 17 (Failure setting<br>
> user credentials)<br>
> May 29 10:44:06 embassy419 polkitd(authority=local): Registered<br>
> Authentication Agent for session /org/freedesktop/ConsoleKit/Session3<br>
> (system bus name :1.88 [/usr/libexec/polkit-gnome-authentication-agent-1],<br>
> object path /org/gnome/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)<br>
> May 29 10:44:13 embassy419 pam: gdm-password[3956]:<br>
> pam_unix(gdm-password:auth): authentication failure; logname= uid=0 euid=0<br>
> tty=:1 ruser= rhost= user=foo<br>
> May 29 10:44:14 embassy419 pam: gdm-password[3956]:<br>
> pam_sss(gdm-password:auth): authentication success; logname= uid=0 euid=0<br>
> tty=:1 ruser= rhost= user=foo<br>
> May 29 10:44:14 embassy419 pam: gdm-password[3956]:<br>
> pam_unix(gdm-password:session): session opened for user foo by (uid=0)<br>
> May 29 10:44:15 embassy419 polkitd(authority=local): Unregistered<br>
> Authentication Agent for session /org/freedesktop/ConsoleKit/Session3<br>
> (system bus name :1.88, object path<br>
> /org/gnome/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)<br>
> (disconnected from bus)<br>
><br>
> But on this machine that was migrated.<br>
> pam: gdm-password[14145]: pam_unix(gdm-password:auth): authentication<br>
> failure; logname= uid=0 euid=0 tty=:1 ruser= rhost= user=david<br>
> May 29 10:42:08 Embassy426 pam: gdm-password[14145]:<br>
> pam_sss(gdm-password:auth): system info: [Preauthentication failed]<br>
> May 29 10:42:08 Embassy426 pam: gdm-password[14145]:<br>
> pam_sss(gdm-password:auth): authentication failure; logname= uid=0 euid=0<br>
> tty=:1 ruser= rhost= user=david<br>
> May 29 10:42:08 Embassy426 pam: gdm-password[14145]:<br>
> pam_sss(gdm-password:auth): received for user david: 17 (Failure setting<br>
> user credentials)<br>
> May 29 10:42:08 Embassy426 pam: gdm-password[14145]:<br>
> pam_winbind(gdm-password:auth): getting password (0x00000010)<br>
> May 29 10:42:08 Embassy426 pam: gdm-password[14145]:<br>
> pam_winbind(gdm-password:auth): pam_get_item returned a password<br>
> May 29 10:42:09 Embassy426 pam: gdm-password[14145]:<br>
> pam_winbind(gdm-password:auth): user 'david' granted access<br>
> May 29 10:42:09 Embassy426 pam: gdm-password[14145]:<br>
> pam_winbind(gdm-password:account): valid_user: wbcGetpwnam gave<br>
> WBC_ERR_DOMAIN_NOT_FOUND<br>
> May 29 10:42:10 Embassy426 pam: gdm-password[14145]:<br>
> pam_unix(gdm-password:session): session opened for user david by (uid=0)<br>
<br>
</div></div>As Dmitri already said, on the migrated systems winbind is still used<br>
and doing the authentication which is still talking ot AD. But you can<br>
see the same error from pam_sss 'Preauthentication failed' which<br>
typically is an indication that the password is wrong.<br>
<br>
How did you migrate the passwords from AD to IPA?<br>
<br>
bye,<br>
Sumit<br>
<div><br>
> May 29 10:42:10 Embassy426 polkitd(authority=local): Unregistered<br>
> Authentication Agent for session /org/freedesktop/ConsoleKit/Session3<br>
> (system bus name :1.85, object path<br>
> /org/gnome/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)<br>
> (disconnected from bus)<br>
<br>
</div><div><div>_______________________________________________<br>
Freeipa-users mailing list<br>
<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
</div></div></blockquote></div></div></div><br><br clear="all"><div class=""><div><br></div>-- <br>Scott Allen<br>Head of IT<br>The Embassy Visual Effects Inc.<br>4th Floor - 177 W 7th Avenue<br>Vancouver, B.C.<br>V5Y 1L8<br>
<a href="tel:604.696.6862%20ext%20241" value="+16046966862" target="_blank">604.696.6862 ext 241</a>
</div></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>Scott Allen<br>Head of IT<br>The Embassy Visual Effects Inc.<br>4th Floor - 177 W 7th Avenue<br>Vancouver, B.C.<br>V5Y 1L8<br>604.696.6862 ext 241
</div>