Integrate AIX host with Active Directory using a KRB5ALDAP compound load module so that users can be created in AD and used in AIX, with unix attributes (registry values) being pulled from AD. Eliminate the need to manage user accounts on a per-server basis.
User attributes are visible with lsuser and returned with ldapsearch. Kerberos authentication shows successful at the domain controller, but a "permission denied" or "invalid login or password" message is displayed when trying to login. Files can be chown-ed to the user accounts, but SU fails.
I have attached a detailed listing of the configs, test commands, and output.
Any and all help or pointers are greatly appreciated.
Pinned topic KRB5ALDAP Module won't allow login or su, all other facets seem functional
Answered question This question has been answered.
Unanswered question This question has not been answered yet.
Updated on 2013-03-07T04:19:57Z at 2013-03-07T04:19:57Z by SystemAdmin
Re: KRB5ALDAP Module won't allow login or su, all other facets seem functional2013-01-21T21:28:04ZThis is the accepted answer. This is the accepted answer.Got it!
2 small things:
1: The primary group of the AD user needed to be a group defined in AD.
(This fixed the su issue.)
2: Changed methods.cfg, added tgt_verify=no to the options.
program = /usr/lib/security/KRB5A
program_64 = /usr/lib/security/KRB5A_64
options = authonly,is_kadmind_compat=no,tgt_verify=no
Re: KRB5ALDAP Module won't allow login or su, all other facets seem functional2013-03-07T04:19:57ZThis is the accepted answer. This is the accepted answer.
- SystemAdmin 110000D4XK