http://bugzilla.novell.com/show_bug.cgi?id=558989 http://bugzilla.novell.com/show_bug.cgi?id=558989#c1 --- Comment #1 from Di Pe 2009-11-28 07:45:05 UTC --- This pam configuration works well for ssh session but if users login via kdm they select the domain they want to login to and are unable to login (no error message comes up). Apparently pam_krb5 eats the backslash and is unable to identify the user name. Nov 27 22:47:55 cpprojweb kdm: :0[4497]: pam_krb5[4497]: pam_setcred (delete credential) called Nov 27 22:48:15 cpprojweb kdm: :0[5543]: pam_krb5[5543]: authentication fails for 'DOMAIN\user' (DOMAINuser@DOMAIN.ORG): User not known to the underlying authentication module (Client not found in Kerberos database) Nov 27 22:48:15 cpprojweb kdm: :0[5543]: pam_winbind(xdm:auth): getting password (0x00000390) Nov 27 22:48:15 cpprojweb kdm: :0[5543]: pam_winbind(xdm:auth): pam_get_item returned a password Nov 27 22:48:15 cpprojweb kdm: :0[5543]: pam_winbind(xdm:auth): user 'DOMAIN\user' granted access Nov 27 22:48:15 cpprojweb kdm: :0[5543]: pam_winbind(xdm:account): user 'user' granted access workaround: in /etc/sysconfig/displaymanager set DISPLAYMANAGER_AD_INTEGRATION="no" Several possible solutions: 1. abandon DISPLAYMANAGER_AD_INTEGRATION as a default in openSUSE. If smb.conf is properly configured the correct domain is automatically chosen and Linux users are not confused by the additional drop down list at login time. DISPLAYMANAGER_AD_INTEGRATION is actually only useful if people have multiple domains or use child domains 2. let pam_winbind execute a kinit so kerberized nfs mounts can be used without having to type kinit -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.