Login to SUSE Manager Server webUI using AD and sssd fails with "password is incorrect" message
This document (000021572) is provided subject to the disclaimer at the end of this document.
Environment
SUSE Manager 4.3 Server
Situation
1) SUSE Manager Server AD and sssd authentication is properly configured based on the guide. The webUI login fails with following error message:
2024-09-06 15:20:27,852 [ajp-nio-0:0:0:0:0:0:0:1-8009-exec-6] WARN com.redhat.rhn.domain.user.legacy.UserImpl - PAM login for user User SOME_USER (id 21, org_id 1) failed with error unix2_chkpwd was inappropriately called from the command line or the password is incorrect.
2) /var/log/sssd/sssd_DOMAIN.log reports following error:
(2024-09-06 15:20:24): [be[DOMAIN]] [ad_gpo_access_send] (0x0400): [RID#10] Configuration hint: PAM service 'susemanager' is not mapped to any Group Policy rule. If you plan to use this PAM service it is recommended to use the ad_gpo_map_* family of options to map this PAM service to a Group Policy rule. PAM services not present in any map will fall back to value set in ad_gpo_default_right, which is currently set to Denied (see manual pages 'man sssd-ad' for more details).
Resolution
1) Into respective section of /etc/sssd/sssd.conf add following line:
ad_gpo_map_permit = +susemanager2) and restart sssd and spacewalk-service
systemctl restart sssd.service spacewalk-service restart
Cause
PAM service susemanager is not mapped to any Group Policy rule.
Disclaimer
This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.
- Document ID:000021572
- Creation Date: 01-Oct-2024
- Modified Date:01-Oct-2024
-
- SUSE Manager Server
- SUSE Manager
For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback[at]suse.com
