<div dir="ltr"> <div class="gmail_extra"> <div class="gmail_quote">On Fri, May 12, 2017 at 3:31 PM, <<a href="mailto:wouter.hummelink@kpn.com" target="_blank">wouter.hummelink@kpn.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <div bgcolor="#FFFFFF"> <div>The shell is shown correctly as ksh in lsuser, so that doesnt appear to be an issue for the ID view. </div></div></blockquote><div> </div><div>My advice would be to start simple ,prove that your authentication works and you can develop a more elaborated setup afterwards. If you combine them all together it will be a trial and error which eventually will work at some point. </div><div>Do you have the correct keytabs in /etc/krb5/krb5.keytab ? can you run kinit (with password and with the keytab) from aix and get a ticket from Kerberos ? can you su to an IPA account ? do you have GSSAPIAuthentication enabled in sshd_config ? </div><div>From what you've described i would suspect that your keytab is not correct , but that should be confirmed only by answering the questions above. </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div bgcolor="#FFFFFF"> <div> </div> <div> </div> <div> </div> <div id="m_-2572230151460738881composer_signature"> <div dir="auto" style="font-size:88%;color:#364f67">Verzonden vanaf mijn Samsung-apparaat</div> </div> -------- Oorspronkelijk bericht -------- Van: Luiz Fernando Vianna da Silva <<a href="mailto:luiz.vianna@tivit.com.br" target="_blank">luiz.vianna@tivit.com.br</a>> Datum: 12-05-17 15:03 (GMT+01:00) Aan: "Hummelink, Wouter" <<a href="mailto:wouter.hummelink@kpn.com" target="_blank">wouter.hummelink@kpn.com</a>>, <a href="mailto:freeipa-users@redhat.com" target="_blank">freeipa-users@redhat.com</a> Onderwerp: Re: [Freeipa-users] IPA Compat + ID Views + AIX 7.1 <div><div class="h5"> <div> Hello Wouter. It may seem silly, but try installing bash on one AIX server and test authenticating against that one. Its a single rpm with no dependencies. For me it did the trick and I ended up doing that on all my AIX servers. Let me know how it goes or if you have any issues. <div class="m_-2572230151460738881moz-signature"> <div class="m_-2572230151460738881WordSection1"> Best Regards __________________________________________ Luiz Fernando Vianna da Silva </div> </div> <div class="m_-2572230151460738881moz-cite-prefix">Em 12-05-2017 09:47, <a class="m_-2572230151460738881moz-txt-link-abbreviated" href="mailto:wouter.hummelink@kpn.com" target="_blank"> wouter.hummelink@kpn.com</a> escreveu: </div> <blockquote type="cite"> <div class="m_-2572230151460738881WordSection1"> Hi All, We’re running a POC to integrate IPA and AIX using AIX KRB5LDAP compound module. All the moving parts seem to be working on their own, however logging in doesn’t work with SSH on AIX reporting Failed password for user <xxx> We’re using ID views to overwrite the user shell and home dirs. (Since AIX will refuse a login with a nonexisting shell (like bash)) AIXs lsuser command is able to find all of the users it’s supposed to and su to IPA users works. Also when a user tries to log in I can see a successful Kerberos conversation to our IPA server. Tips for troubleshooting would be much appreciated, increasing SSH log level did not produce any meaningful logging. =============== Configuration Excerpt ================================================================ /etc/security/ldap/ldap.cfg: ldapservers:<a href="http://ipaserver.example.org" target="_blank">ipaserver.example.org</a> binddn:uid=srvc-aixservice,cn=users,cn=accounts,dc=example,dc=org bindpwd:{DESv2}<redacted> authtype:ldap_auth useSSL:TLS ldapsslkeyf:/etc/security/ldap/example.kdb ldapsslkeypwd:{DESv2}4688216124E33174C03FBBB420 88FA8 932F219867AA7C2C552A12BEEC0CC67 useKRB5:yes krbprincipal:host/<a href="http://aixlpar.example.org" target="_blank">aixlpar.example.org</a> krbkeypath:/etc/krb5/krb5.keytab userattrmappath:/etc/security/ldap/2307user.map groupattrmappath:/etc/security/ldap/2307group.map userbasedn:cn=users,cn=aixtest,cn=views,cn=compat,dc=example,dc=org groupbasedn:cn=groups,cn=aixtest,cn=views,cn=compat,dc=example,dc=org netgroupbasedn:cn=ng,cn=compat,dc=example,dc=org automountbasedn:cn=default,cn=automount,dc=example,dc=org etherbasedn:cn=computers,cn=accounts,dc=example,dc=org userclasses:posixaccount,account,shadowaccount groupclasses:posixgroup ldapport:389 searchmode:ALL defaultentrylocation:LDAP /etc/security/user default: SYSTEM = KRB5LDAP or compat /etc/methods.cfg <div style="border:none;border-left:solid windowtext 1.0pt;padding:0cm 0cm 0cm 4.0pt;margin-left:1.0cm;margin-right:0cm"> LDAP: program = /usr/lib/security/LDAP program_64 =/usr/lib/security/LDAP64 NIS: program = /usr/lib/security/NIS program_64 = /usr/lib/security/NIS_64 DCE: program = /usr/lib/security/DCE KRB5: program = /usr/lib/security/KRB5 program_64 = /usr/lib/security/KRB5_64 options = authonly,is_kadmind_compat=no,tgt_verify=yes,kadmind=no,keep_creds=yes,allow_expired_pwd=no KRB5LDAP: options = auth=KRB5,db=LDAP </div> Met vriendelijke groet, <div style="border:none;border-bottom:solid windowtext 1.0pt;padding:0cm 0cm 1.0pt 0cm"> Wouter Hummelink </div> Technical Consultant - Enterprise Webhosting / Tooling & Automation T: <a href="tel:+31%206%2012882447" value="+31612882447" target="_blank">+31-6-12882447</a> E: <a href="mailto:wouter.hummelink@kpn.com" target="_blank"> wouter.hummelink@kpn.com</a> </div> </blockquote> </div> </div></div></div> -- Manage your subscription for the Freeipa-users mailing list: <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project </blockquote></div> </div></div>