ccb17c7352
With default priority (128), pam-auth-update put module pam_sss after module pam_unix in /etc/pam.d/common-auth, and then a user with a local account and local password synchronized with AD password will never be granted a Kerberos TGT on session opening.
24 lines
549 B
Plaintext
24 lines
549 B
Plaintext
Name: Yourdev authentication (SSSD)
|
|
Default: no
|
|
Priority: 512
|
|
Conflicts: sss
|
|
|
|
Auth-Type: Primary
|
|
Auth:
|
|
[success=end default=ignore] pam_sss.so use_first_pass
|
|
Auth-Initial:
|
|
[success=end default=ignore] pam_sss.so forward_pass
|
|
Account-Type: Additional
|
|
Account:
|
|
sufficient pam_localuser.so
|
|
[default=bad success=ok user_unknown=ignore] pam_sss.so
|
|
Session-Type: Additional
|
|
Session-Interactive-Only: yes
|
|
Session:
|
|
optional pam_sss.so
|
|
Password-Type: Primary
|
|
Password:
|
|
sufficient pam_sss.so use_authtok
|
|
Password-Initial:
|
|
sufficient pam_sss.so
|