0

On xenial, the lock screen doesn't work for me. Whether I enter the correct password or not, it won't let me in. However, if I click on the menu at the top right corner of the screen and choose "switch user," but choose the same user as at the lock screen it lets me right in.

At the lock screen, authentication seems to work correctly. It just doesn't authorize me. Here's what I see in /var/log/auth.log:

May  3 11:57:44 hostname compiz: pam_krb5(unity:auth): user myuser authenticated as [email protected]
May  3 11:57:44 hostname compiz: gkr-pam: unlocked login keyring
May  3 11:57:44 hostname compiz: pam_sss(unity:account): Access denied for user myuser: 6 (Permission denied)

Authentication is from an Active Directory domain. I'm using sssd. This same configuration works fine on Trusty, Vivid, and Wily. Only seems to be broken on Xenial. I've tried on a workstation that was upgraded from Wily, as well as a fresh install. I'm having a heck of a time figuring out what needs to be done differently.

Only AD accounts are affected by this. Local accounts are not.

It also fails when running something via the gui that requires elevated privileges. For example, when installing software from the Ubuntu Software Center. It won't let an AD account authorize installation, but it will allow a local user to authorize it. Yet from the command line, AD accounts can use sudo with no issues.

Something is making pam unhappy. Any idea what it could be?

1
  • I've tried using gdm3 instead of lightdm. But that was much worse. After setting gdm3 to be the default DM and rebooting, I just got a blank screen Never get a login screen. I am using the proprietary Nvidia video drivers, and must be affected by this other bug: bugs.launchpad.net/ubuntu/xenial/+source/gdm3/+bug/1559576
    – mrwboilers
    Commented May 4, 2016 at 14:46

4 Answers 4

Reset to default
2

This fix was posted as a comment to the bug that vargax submitted. If you add:

ad_gpo_map_interactive = +unity

to the [domain/domainname] section of /etc/sssd/sssd.conf, the lock screen problem goes away.

Unfortunately, this does not solve the problem with elevated privileges in the gui.

1

Those are two separate (but likely related) bugs. No one posted a log that demonstrates the error of the elevated privileges, so I can't tell you what option to add to sssd.conf to fix it.

I got "unity" from "pam_sss(unity:account): Access denied" (the text before the ":account" is the name of the PAM service being contacted).

The bug here is that the downstream Ubuntu maintainer didn't adjust the default set of values for the AD provider to include whatever PAM service is in use here, and it denies by default if it's unknown.

The ad_gpo_map_interactive = +unity is a workaround; I've submitted a patch to SSSD upstream to add this by default. I might do the same for whatever is affecting the elevated privileges if it doesn't conflict with anything else. Otherwise it will be Ubuntu's responsibility to modify that in the downstream package.

2
  • When trying to use elevated privileges from the gui, this line is in auth.log: May 6 09:45:38 myhostname polkit-agent-helper-1[23184]: pam_sss(polkit-1:account): Access denied for user myuser: 6 (Permission denied) --- so, should I just add "+polkit-1 to that same line in sssd.conf?
    – mrwboilers
    Commented May 6, 2016 at 14:52
  • I tried adding +polkit-1 to that line and it works! So thanks for not only providing a fix, but also teaching me a little about how this all works.
    – mrwboilers
    Commented May 6, 2016 at 14:58
0

Check if /etc/fstab is correctly set to the disc partitions.

Then i would reconfigure lightdm itself

For last resource i would try reinstalling ubuntu itself seeking the user and password settings during installation.

PAM seems to be very tricky.

4
  • I tried dpkg-reconfigure lightdm, but that didn't have any affect. For the re-install, how can I configure AD authentication during the OS install? Right now, I just have a script that I run after the OS install that takes care of AD config.
    – mrwboilers
    Commented May 4, 2016 at 16:04
  • How did you installed it?
    – Baraujo85
    Commented May 4, 2016 at 17:37
  • The OS was just installed from booting to the iso file downloaded from cannonical. I have bash scripts that I run after that for further configuration. The scripts worked fine for trusty, vivid, and wily. But something has changed with the move to xenial.
    – mrwboilers
    Commented May 4, 2016 at 21:48
  • Didn't this installation required username and password to be set ? Maybe theres some kind of scrambled config on /etc/pam.d , theres a lot of config files there. When i had trouble with authentication, i reinstalled lightdm then ubuntu itself: it asked me to generate username and password at the begining of it. You coud try another installation method too.
    – Baraujo85
    Commented May 5, 2016 at 19:31
0

I just submit a bug report: https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1578415

Maybe you guys can mark yourself as affected...

2
  • There is another issue related with SSSD in Xenial... Looks like that the current version of SSSD requires the adcli package for keytab renewal when joining to AD Domain.
    – vargax
    Commented Jun 8, 2016 at 15:25
  • Another bug report: bugs.launchpad.net/ubuntu/+source/sssd/+bug/1590471
    – vargax
    Commented Jun 8, 2016 at 15:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .