lightdm does not ask for a password when using sssd

Bug #1081797 reported by skinny
282
This bug affects 7 people
Affects Status Importance Assigned to Milestone
lightdm (Ubuntu)
Confirmed
Undecided
Unassigned

Bug Description

1) the release is Quantal (12.10)
2) the package version
lightdm:
  Installed: 1.4.0-0ubuntu2
sssd:
  Installed: 1.9.1-0ubuntu1

3) Lightdm should ask for my password when i goto login.

4) lightdm does not prompt for password for network users

    I have been using SSSD to allow authentication to our AD server.
    My configuration works on all prior versions of ubuntu at least back to 10.04.
    This only happens when using gui from command line I am able to login as the user and it prompts for a password.
    Under user accounts for the network user the option for Automatic Login is set to off
    Command line login works correctly this is only a problem from the gui login page

To recreate this issue:

1.) install 12.10
2.) install packages ntp sssd libnss-sss libpam-sss krb5-user
3.) configure sssd example below
4.) verify that sfu has been setup on AD server and user has been configured with a uid
5.) put your AD cert in the directory supplied
6.) Login as network user from command line to verify sssd is working correctly
7.) reboot and click on network user in lightdm
8.) click login (notice no password prompt)

SSSD EXAMPLE

[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam
domains = example.com

[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3

[pam]
reconnection_retries = 3
debug_level = 3

[domain/EXAMPLE.COM]
enumerate = true
min_id = 1
id_provider = ldap
ldap_uri = ldaps://DC1.example.com/
ldap_user_search_base = dc=example,dc=com
ldap_group_search_base = dc=example,dc=com
ldap_default_bind_dn = CN=binduser,CN=users,dc=example,dc=com
ldap_default_authtok_type = password
ldap_default_authtok = bindpassword

ldap_user_object_class = user
ldap_user_name = sAMAccountName
ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber
ldap_user_home_directory = unixHomeDirectory
ldap_user_shell = loginShell
ldap_user_principal = userPrincipalName
ldap_user_member = msSFU30PosixMemberOf

ldap_group_object_class = group
ldap_group_name = sAMAccountName
ldap_group_gid_number = gidNumber
ldap_group_member = member
ldap_tls_cacertdir = /etc/ssl/certs/
ldap_tls_cacert = /etc/ssl/certs/adcert.pem

[domain/example.com]
ldap_id_use_start_tls = False
cache_credentials = True
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
debug_level = 3
ldap_schema = rfc2307bis
ldap_force_upper_case_realm = true
krb5_realm = example.com
ldap_search_base = DC=example,DC=com
ldap_uri = ldaps://DC1.example.com/
krb5_kpasswd = DC1.example.com
krb5_kdcip = DC1.example.com
ldap_tls_cacertdir = /etc/ssl/certs/
ldap_tls_cacert = /etc/ssl/certs/adcert.pem

ProblemType: Bug
DistroRelease: Ubuntu 12.10
Package: lightdm 1.4.0-0ubuntu2
ProcVersionSignature: Ubuntu 3.5.0-17.28-generic 3.5.5
Uname: Linux 3.5.0-17-generic x86_64
NonfreeKernelModules: nvidia
ApportVersion: 2.6.1-0ubuntu6
Architecture: amd64
Date: Wed Nov 21 14:37:37 2012
InstallationDate: Installed on 2012-11-21 (0 days ago)
InstallationMedia: Ubuntu 12.10 "Quantal Quetzal" - Release amd64 (20121017.5)
MarkForUpload: True
ProcEnviron:
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: lightdm
UpgradeStatus: No upgrade log present (probably fresh install)

Revision history for this message
skinny (skinnyquiver) wrote :
information type: Private Security → Public
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in lightdm (Ubuntu):
status: New → Confirmed
information type: Public → Public Security
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.