4

kinit -p 'username' works -- no problem with the setup of the Kerberos realm.

I can't get the login from the GUI to work, however.

Client auth.log:

pam_krb5(gdm3:auth): user <username> authenticated as <user>@<realm>
gkr-pam: error looking up user information

Server krb5kdc.log:

Oct 01 02:27:23 debian krb5kdc[6996](info): AS_REQ (4 etypes {18 17 16 23}) 10.0.0.11:
NEEDED_PREAUTH: <user>@<realm> for krbtgt/<realm>@<realm>, Additional
pre-authentication required


Oct 01 02:27:23 debian krb5kdc[6996](info): AS_REQ (4 etypes {18 17 16 23}) 10.0.0.11: 
ISSUE: authtime 1412144843, etypes {rep=18 tkt=18 ses=18}, <user>@<realm> for 
krbtgt/<realm>@<realm>

In other words, Kerberos server issues the ticket to the client without a problem, but the login from the GUI doesn't work. Any thoughts are really appreciated!

Both client and server are running Debian 7.6.0 x86_64.

Aroll605
  • 151
  • 1
  • 4

1 Answers1

1

The key line to look at is:

gkr-pam: error looking up user information

Successful authentication doesn't necessarily mean access will be granted by PAM. The user must be recognized by the operating system, and must also pass the accounting checks (the account modules in the PAM stack).

The error above suggests that the user either does not exist on the system (from the console, does getent passwd <username> and getent shadow <username> both work?), or one of the PAM modules you have configured is having difficulty obtaining information about the user from a remote source.

Focus your investigation in this direction and you should be able to identify and correct the issue.

Andrew B
  • 31,858
  • 12
  • 90
  • 128
  • I got one step further by installing 'libnss-ldapd' as to get all the user info from my LDAP server. The authentication process works flawlessly now --> a shell login works perfectly. However, I still can't get past the GUI. It doesn't let me to the desktop, it simply authenticates me and freezes (on Debian) and reboots the lightdm (on Ubuntu 14.04). I'm so close I can smell it, but this part is confusing me :/ Any ideas? – Aroll605 Oct 02 '14 at 04:00
  • I enabled pam_mkhomedir module and it solved the problem. Thank you so much for your help! – Aroll605 Oct 02 '14 at 04:19