Re: [Freeipa-users] Authenticate on GNOME display manager with freeipa

2017-05-15 Thread Timo Aaltonen
On 12.05.2017 12:25, tuxderlinuxfuch...@gmail.com wrote: > Thanks! > > I followed this manual: > https://help.ubuntu.com/lts/serverguide/sssd-ad.html#sssd-ad-mkhomedir > > added the line > > sessionrequiredpam_mkhomedir.so skel=/etc/skel/ umask=0022 > > to the file

Re: [Freeipa-users] Authenticate on GNOME display manager with freeipa

2017-05-12 Thread Sumit Bose
On Fri, May 12, 2017 at 03:00:42PM +0200, tuxderlinuxfuch...@gmail.com wrote: > It worked with pam_mkhomedir. So I don't see anything left to do at the > moment > ah, I thought ... > > On 12-May-17 12:52 PM, Sumit Bose wrote: > > On Fri, May 12, 2017 at 12:11:28PM +0200,

Re: [Freeipa-users] Authenticate on GNOME display manager with freeipa

2017-05-12 Thread tuxderlinuxfuch...@gmail.com
It worked with pam_mkhomedir. So I don't see anything left to do at the moment On 12-May-17 12:52 PM, Sumit Bose wrote: > On Fri, May 12, 2017 at 12:11:28PM +0200, tuxderlinuxfuch...@gmail.com wrote: >> The directory didn't exist > Then I guess that the process doesn't has the needed permissions

Re: [Freeipa-users] Authenticate on GNOME display manager with freeipa

2017-05-12 Thread Sumit Bose
On Fri, May 12, 2017 at 12:11:28PM +0200, tuxderlinuxfuch...@gmail.com wrote: > The directory didn't exist Then I guess that the process doesn't has the needed permissions during the session phase anymore. Please try to replace pam_mkhomedir by pam_oddjob_mkhomedir. This will try to create the

Re: [Freeipa-users] Authenticate on GNOME display manager with freeipa

2017-05-12 Thread tuxderlinuxfuch...@gmail.com
The directory didn't exist On 12-May-17 11:48 AM, Sumit Bose wrote: > On Fri, May 12, 2017 at 11:25:04AM +0200, tuxderlinuxfuch...@gmail.com wrote: >> Thanks! >> >> I followed this manual: >> https://help.ubuntu.com/lts/serverguide/sssd-ad.html#sssd-ad-mkhomedir >> >> added the line >> >>

Re: [Freeipa-users] Authenticate on GNOME display manager with freeipa

2017-05-12 Thread Sumit Bose
On Fri, May 12, 2017 at 12:50:08AM +0200, tuxderlinuxfuch...@gmail.com wrote: > I have attached the syslog with gdm debug mode enabled > > > On 11-May-17 1:54 PM, Sumit Bose wrote: > > On Thu, May 11, 2017 at 01:29:33PM +0200, tuxderlinuxfuch...@gmail.com > > wrote: > >> Hello, > >> > >> I have

Re: [Freeipa-users] Authenticate on GNOME display manager with freeipa

2017-05-11 Thread tuxderlinuxfuch...@gmail.com
I have attached the syslog with gdm debug mode enabled On 11-May-17 1:54 PM, Sumit Bose wrote: > On Thu, May 11, 2017 at 01:29:33PM +0200, tuxderlinuxfuch...@gmail.com wrote: >> Hello, >> >> I have attached the requested files. > The logs indicate that access was granted by SSSD and that gdm

Re: [Freeipa-users] Authenticate on GNOME display manager with freeipa

2017-05-11 Thread Sumit Bose
On Thu, May 11, 2017 at 01:29:33PM +0200, tuxderlinuxfuch...@gmail.com wrote: > Hello, > > I have attached the requested files. The logs indicate that access was granted by SSSD and that gdm even called pam_open_session. Did gdm login worked with the 'allow all' rule? Are there any other hints

Re: [Freeipa-users] Authenticate on GNOME display manager with freeipa

2017-05-10 Thread Sumit Bose
On Tue, May 09, 2017 at 11:12:13PM +0200, tuxderlinuxfuch...@gmail.com wrote: > Hello everyone, > > I set up my freeIPA instance and it works very well for my client > computers (Ubuntu Desktop 16.04.2 LTS), I can login via SSH using a > freeIPA managed user account. > > My own HBAC rule also

Re: [Freeipa-users] Authenticate on GNOME display manager with freeipa

2017-05-10 Thread Jason B. Nance
Make sure you are using "reply-all" as your replies are falling off the mailing list and coming to me only. > They do have some of these lines. Assuming your common-* modules are setup correctly (which you can verify by looking at your ssh module and seeing if it uses common-* or if the sssd

Re: [Freeipa-users] Authenticate on GNOME display manager with freeipa

2017-05-09 Thread Jason B. Nance
> I set up my freeIPA instance and it works very well for my client > computers (Ubuntu Desktop 16.04.2 LTS), I can login via SSH using a > freeIPA managed user account. > But I cannot login to the GNOME 3 Desktop on the client. I used the > netinstall ISO image of Ubuntu. During installation, I

Re: [Freeipa-users] Authenticate on GNOME display manager with freeipa

2017-05-09 Thread Jason B. Nance
> But I cannot login to the GNOME 3 Desktop on the client. I used the > netinstall ISO image of Ubuntu. During installation, I have chose > "Ubuntu GNOME Desktop" as the only desktop. > > So my display manager is gdm3. It sounds as if GDM has its own PAM module that isn't configured to use SSSD.