Description Felix Botner 2015-06-23 15:47:25 CEST

root@kde2:~# more /etc/pam.d/common-auth| grep 'ldap\|krb'
auth    [authinfo_unavail=ignore success=2 default=3]   pam_krb5.so minimum_uid=1000 try_first_pass
auth    [authinfo_unavail=ignore success=1 default=2]   pam_ldap.so use_first_pass


root@kde2:~# more /etc/pam.d/common-account| grep 'ldap\|krb'
account [success=1 user_unknown=1 authinfo_unavail=1  default=ignore]   pam_ldap.so 
account required                        pam_krb5.so minimum_uid=1000

For auth pam_krb5 (samba4) is used, for account pam_ldap (openldap).

Problem: if samba (krb5) password expiry and openldap password expiry are not in sync, the login on UCC clients fails (auth pam_krb5 works but account pam_ldap fails)