<div dir="ltr"> <div class="gmail_extra"> <div class="gmail_quote">On Fri, May 12, 2017 at 2:32 PM, <<a href="mailto:wouter.hummelink@kpn.com" target="_blank">wouter.hummelink@kpn.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <div lang="EN-US"> <div class="gmail-m_7926556652586221045WordSection1"> Hi All, We’re running a POC to integrate IPA and AIX using AIX KRB5LDAP compound module. All the moving parts seem to be working on their own, however logging in doesn’t work with SSH on AIX reporting Failed password for user <xxx> We’re using ID views to overwrite the user shell and home dirs. (Since AIX will refuse a login with a nonexisting shell (like bash))</div></div></blockquote><div> </div><div>Why don't you just use the /bin/sh as default shell in IPA ? In aix /bin/sh is the same as /bin/ksh and in linux it is a symlink to /bin/bash . </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div lang="EN-US"><div class="gmail-m_7926556652586221045WordSection1"> AIXs lsuser command is able to find all of the users it’s supposed to and su to IPA users works. Also when a user tries to log in I can see a successful Kerberos conversation to our IPA server. </div></div></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div lang="EN-US"><div class="gmail-m_7926556652586221045WordSection1"> Tips for troubleshooting would be much appreciated, increasing SSH log level did not produce any meaningful logging. =============== Configuration Excerpt ================================================================ /etc/security/ldap/ldap.cfg: ldapservers:ipaserver.example.org binddn:uid=srvc-aixservice,cn=users,cn=accounts,dc=example,dc=org bindpwd:{DESv2}<redacted> authtype:ldap_auth useSSL:TLS ldapsslkeyf:/etc/security/ldap/example.kdb ldapsslkeypwd:{DESv2}4688216124E33174C03FBBB420 88FA8 932F219867AA7C2C552A12BEEC0CC67 useKRB5:yes krbprincipal:host/aixlpar.<a href="http://example.org">example.org</a> krbkeypath:/etc/krb5/krb5.keytab userattrmappath:/etc/security/ldap/2307user.map groupattrmappath:/etc/security/ldap/2307group.map userbasedn:cn=users,cn=aixtest,cn=views,cn=compat,dc=example,dc=org groupbasedn:cn=groups,cn=aixtest,cn=views,cn=compat,dc=example,dc=org netgroupbasedn:cn=ng,cn=compat,dc=example,dc=org automountbasedn:cn=default,cn=automount,dc=example,dc=org etherbasedn:cn=computers,cn=accounts,dc=example,dc=org userclasses:posixaccount,account,shadowaccount groupclasses:posixgroup ldapport:389 searchmode:ALL defaultentrylocation:LDAP /etc/security/user default: SYSTEM = KRB5LDAP or compat</div></div></blockquote><div> </div><div>I am using the following settings in in /etc/security/user: </div><div>SYSTEM = KRB5LDAP </div><div>registry = KRB5LDAP </div><div>it works for AIX5,6 and 7 in my setup. </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div lang="EN-US"><div class="gmail-m_7926556652586221045WordSection1"> /etc/methods.cfg <div style="border-width:medium medium medium 1pt;border-style:none none none solid;border-color:currentcolor currentcolor currentcolor windowtext;padding:0cm 0cm 0cm 4pt;margin-left:1cm;margin-right:0cm"> LDAP: program = /usr/lib/security/LDAP program_64 =/usr/lib/security/LDAP64 NIS: program = /usr/lib/security/NIS program_64 = /usr/lib/security/NIS_64 DCE: program = /usr/lib/security/DCE KRB5: program = /usr/lib/security/KRB5 program_64 = /usr/lib/security/KRB5_64 options = authonly,is_kadmind_compat=no,tgt_verify=yes,kadmind=no,keep_creds=yes,allow_expired_pwd=no KRB5LDAP: options = auth=KRB5,db=LDAP </div> Met vriendelijke groet, <div style="border-width:medium medium 1pt;border-style:none none solid;border-color:currentcolor currentcolor windowtext;padding:0cm 0cm 1pt"> Wouter Hummelink </div> Technical Consultant - Enterprise Webhosting / Tooling & Automation T: <a value="+31612882447">+31-6-12882447</a> E: <a> wouter.hummelink@kpn.com</a> </div> </div> -- Manage your subscription for the Freeipa-users mailing list: <a href="https://www.redhat.com/">https://www.redhat.com/</a>mailman/listinfo/freeipa-users Go to <a href="http://freeipa.org">http://freeipa.org</a> for more info on the project </blockquote></div> </div></div>