Authentication Failure PAM/LDAP

[gitouttahere]

I'm having significant trouble getting db authentication to function. I try to log into a phpMyAdmin interface using ldapuser1 or ldapuser2 and It's like it tries but can't seem to make it happen. Could someone help point me in the right direction to get this functional?

Overview
1) I have a server setup to authenticate against a 389 LDAP server.
2) The SSH session authentication works. i.e. I'm able to log in via LDAP credentials to a shell.
3) I've compiled the plugin successfully and loaded it into MySQL.
4) I've added pam.d/ entries as specified.
5) I've attempted to use the auth_pam and auth_pam_compat options.
5) I've restarted services and rebooted the server.

NOTE: any information deemed sensitive has been modified to remove it but keep the messages intact otherwise.

In the end I continue to get the following errors in auth.log:

Aug 11 17:01:45 dbhost mysqld[2554]: pam_unix(mysqld:auth): conversation failed
Aug 11 17:01:45 dbhost mysqld[2554]: pam_unix(mysqld:auth): auth could not identify password for [ldapuser1]

My setup is as follows:

{ /etc/pam.d/mysqld contents }

# Standard Un*x authentication.
auth required pam_warn.so
auth required pam_unix.so audit
account required pam_unix.so audit

{ MySQL Lib Directory Contents }

root@dbhost:/etc/pam.d# ls /usr/lib/mysql/plugin/
adt_null.so auth_pam.so dialog.la mypluglib.so semisync_master.so
auth_pam_compat.la auth.so dialog.so qa_auth_client.so semisync_slave.so
auth_pam_compat.so auth_socket.so ha_example.so qa_auth_interface.so test_auth_pam_client.la
auth_pam.la auth_test_plugin.so libdaemon_example.so qa_auth_server.so test_auth_pam_client.so

{ MySQL Plugin Info }

mysql> show plugins;
+--------------------------+----------+--------------------+--------------------+---------+
| Name | Status | Type | Library | License |
+--------------------------+----------+--------------------+--------------------+---------+
| binlog | ACTIVE | STORAGE ENGINE | NULL | GPL |
| mysql_native_password | ACTIVE | AUTHENTICATION | NULL | GPL |
| mysql_old_password | ACTIVE | AUTHENTICATION | NULL | GPL |
| MEMORY | ACTIVE | STORAGE ENGINE | NULL | GPL |
| MyISAM | ACTIVE | STORAGE ENGINE | NULL | GPL |
| CSV | ACTIVE | STORAGE ENGINE | NULL | GPL |
| MRG_MYISAM | ACTIVE | STORAGE ENGINE | NULL | GPL |
| InnoDB | ACTIVE | STORAGE ENGINE | NULL | GPL |
| INNODB_TRX | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_LOCKS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_LOCK_WAITS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMP | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMP_RESET | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMPMEM | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMPMEM_RESET | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_BUFFER_PAGE | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_BUFFER_PAGE_LRU | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_BUFFER_POOL_STATS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| BLACKHOLE | ACTIVE | STORAGE ENGINE | NULL | GPL |
| ARCHIVE | ACTIVE | STORAGE ENGINE | NULL | GPL |
| FEDERATED | DISABLED | STORAGE ENGINE | NULL | GPL |
| PERFORMANCE_SCHEMA | ACTIVE | STORAGE ENGINE | NULL | GPL |
| partition | ACTIVE | STORAGE ENGINE | NULL | GPL |
| auth_pam | ACTIVE | AUTHENTICATION | auth_pam.so | GPL |
| auth_pam_compat | ACTIVE | AUTHENTICATION | auth_pam_compat.so | GPL |
+--------------------------+----------+--------------------+--------------------+---------+

{ MySQL access to the shadow file }

root@dbhost:/etc/pam.d# cat /etc/group |grep shadow
shadow:x:42:mysql

root@dbhost:/etc/pam.d# ll /etc/shad*
-rw-r----- 1 root shadow 863 Jun 29 14:55 /etc/shadow

{ General results of getent call to check LDAP connectivity }

root@dbhost:/etc/pam.d# getent passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
Debian-exim:x:101:103::/var/spool/exim4:/bin/false
statd:x:102:65534::/var/lib/nfs:/bin/false
sshd:x:103:65534::/var/run/sshd:/usr/sbin/nologin
ntp:x:104:106::/home/ntp:/bin/false
mysql:x:105:107:MySQL Server,,,:/nonexistent:/bin/false
ldapuser1:*:5000:5000:LDAP USER:/home/ldapuser1:/bin/bash
ldapuser2:*:5001:5001:LDAP USER:/home/ldapuser2:/bin/bash

{ I've used the following reference sites for setup or troubleshooting }

http://www.heitorlessa.com/mysql-pam-and-active-directory-authentication/
http://www.percona.com/doc/percona-pam-for-mysql/manual.html

[gitouttahere (tcrass)]

Anyone have any ideas about this?

[gitouttahere (tcrass)]

Still hoping for any feedback on this bugger if anyone has it.

[Sergei Glushchenko (sergei.glushchenko)]

Hi

You may find this blog post useful
http://www.mysqlperformanceblog.com/2013/08/14/getting-percona-pam-to-work-with-percona-server-its-client-apps/

[Sergei Glushchenko (sergei.glushchenko)]

Something goes wrong in client-server communication, I suspect that your PHP cannot load required client plugin.