We are preparing 12.04 LTS for our userbase and have done some basic configuration to the login screen (disabled guest account, removed user list, etc). However, one thing that I've noticed is that once a user has authenticated at the login screen (KRB5), a user will no longer have to enter their password. In fact, even after reboot, if a user has previously authenticated, all they have to do is type their username and they can login with no other prompts.
Obviously this is a major security risk at the enterprise level. Please let me know if you need any other information. Any advice would be greatly appreciated!
Thanks for your consideration, but we've realized it is a GID conflict. We have an LDAP group with GID 112, which happens to be the GID of the nopasswdlogin group at least in Precise. We'll be migrating that LDAP group to another GID. This is just an FYI if others see this behavior by chance. I can't close this for another few hours.