<html><head><meta http-equiv="Content-Security-Policy" content="script-src 'self'; img-src * cid: data:;"></head><body style="background-color: rgb(255, 255, 255); background-image: initial; line-height: initial;"><div id="response_container_BBPPID" style="outline:none;font-size:initial;font-family:"Calibri","Slate Pro",sans-serif,"sans-serif"" dir="auto" contenteditable="false"> <div name="BB10" dir="auto" style="width: 100%; padding: initial; font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);"> Well just quickly looking at the Pam setup I only see the kerberos module no Ldap or sssd modules so authentication should be working but not authorization while is fine if there is a local user that matches but other wise it won't work.</div><div name="BB10" id="BB10_response_div_BBPPID" dir="auto" style="width: 100%; padding: initial; font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);">That said if the palm file is incomplete and you do have one of the Ldap or sssd modules loaded then I would look at selinux the python policy tools are very helpful with debugging that</div> <div name="BB10" dir="auto" style="width: 100%; padding: initial; font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);"> <br style="display:initial"></div> <div id="blackberry_signature_BBPPID" name="BB10" dir="auto"> <div name="BB10" dir="auto" style="padding: initial; font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);">Sent from my BlackBerry - the most secure mobile device</div> </div></div><div id="_original_msg_header_BBPPID" dir="auto"> <table width="100%" style="background-color: white; border-spacing: 0px; display: table; outline: none;" contenteditable="false"> <tbody><tr><td colspan="2" style="padding: initial; font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);"> <div style="border-right: none; border-bottom: none; border-left: none; border-image: initial; border-top: 1pt solid rgb(181, 196, 223); padding: 3pt 0in 0in; font-family: Tahoma, "BB Alpha Sans", "Slate Pro"; font-size: 10pt;"> <div id="from"><b>From:</b> devendra@redhat.com</div><div id="sent"><b>Sent:</b> October 4, 2017 7:54 PM</div><div id="to"><b>To:</b> spacewalk-list@redhat.com</div><div id="reply_to"><b>Reply-to:</b> spacewalk-list@redhat.com</div><div id="subject"><b>Subject:</b> [Spacewalk-list] LDAP auth issues - spacewalk 2.4</div></div></td></tr></tbody></table><div style="border-right: none; border-bottom: none; border-left: none; border-image: initial; border-top: 1pt solid rgb(186, 188, 209); display: block; padding: initial; font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);"></div> <br> </div><div name="BB10" dir="auto" style="background-image: initial; line-height: initial; outline: none;" contenteditable="false"><div dir="ltr"><div class="gmail_quote"><div dir="ltr"><br></div><div dir="ltr">Hello team, <div><br></div><div>Couldnt find a Spacewalk distribution list hence sending to the Satellite mailing list. </div><div><br></div><div>Need help on auth issues with Spacewalk 2.4.</div><div><br></div><div>Customer has a spacewalk server for managing package updates. Login to the UI using local admin and 'spacewadmin' user is successful. Login via LDAP account fails. </div><div><br></div><div><br></div><div><b>==> /var/log/secure <==</b><br></div><div><div>Sep 27 12:06:40 spacewalk-server-01 java: pam_krb5[16775]: TGT verified</div><div>Sep 27 12:06:40 spacewalk-server-01 java: pam_krb5[16775]: authentication succeeds for 'd859112' (<a href="mailto:d859112@CORE.DIR.TELSTRA.COM">d859112@CORE.DIR.TELSTRA.COM</a>)</div><div>Sep 27 12:06:40 spacewalk-server-01 java: PAM audit_log_acct_message() failed: Permission denied<br></div><div><br></div><div><b>==> /var/log/messages <==</b></div><div>Sep 27 12:06:40 spacewalk-server-01 server: 2017-09-27 12:06:40,459 [ajp-bio-0:0:0:0:0:0:0:1-8009-<wbr>exec-438] WARN <wbr><a href="http://com.redhat.rhn.domain.user">com.redhat.rhn.domain.user</a><wbr>.<wbr><wbr><a href="http://legacy.UserImpl">legacy.UserImpl</a><wbr> - PAM login for user User d859112 (id 26, org_id 5) failed with error System error.</div></div><div><br></div><div>As per my understanding, LDAP auth is set up correctly. </div><div><br></div><div>The PAM module is as follows:</div><div><div>#%PAM-1.0</div><div>auth required pam_<wbr><a href="http://env.so">env.so</a><wbr></div><div>auth sufficient pam_<wbr><a href="http://krb5.so">krb5.so</a><wbr> no_user_check</div><div>auth required pam_<wbr><a href="http://deny.so">deny.so</a><wbr></div><div>account required pam_<wbr><a href="http://krb5.so">krb5.so</a><wbr> no_user_check</div></div><div><br></div><div><br></div><div>The /etcrhn/<wbr><a href="http://rhn.conf">rhn.conf</a><wbr> is attached for reference. </div><div><br></div><div>Looking for assistance on fixing this. </div><div><br></div><div>Thank you all. </div><div><br></div><div><br></div><div><div><div class="gmail_signature"><div dir="ltr"><div style="font-size:12.8px"><font color="#888888"><br class="gmail-Apple-interchange-newline">--</font></div><div style="font-size:12.8px"><span style="color:rgb( 136 , 136 , 136 );font-size:12.8px">Dev</span></div></div></div></div><div class="gmail_quote"></div><div><div class="gmail-m_6931607692364487702gmail_signature"><div dir="ltr"><div style="font-size:12.8px"><br></div></div></div></div> </div></div> </div><br></div> </div></body></html>