Solaris 9 10 - pam.conf - LDAP - su - user login - DS 6.3.1

Question

We are trying to configure our Solaris clients to use LDAP for authentication. We have modified the nsswitch.conf and pam.conf. The pam.conf looks like this:
login auth requisite pam_authtok_get.so.1 debug
login auth required pam_dhkeys.so.1 debug
login auth required pam_dial_auth.so.1 debug
login auth binding pam_unix_cred.so.1
login auth binding pam_unix_auth.so.1 server_policy debug
login auth required pam_ldap.so.1 use_first_pass debug
rlogin auth sufficient pam_rhosts_auth.so.1
rlogin auth requisite pam_authtok_get.so.1
rlogin auth required pam_dhkeys.so.1
rlogin auth binding pam_unix_cred.so.1
rlogin auth binding pam_unix_auth.so.1 server_policy
rlogin auth required pam_ldap.so.1 use_first_pass debug
dtlogin auth requisite pam_authtok_get.so.1
dtlogin auth required pam_dhkeys.so.1
dtlogin auth binding pam_unix_cred.so.1
dtlogin auth binding pam_unix_auth.so.1 server_policy
dtlogin auth required pam_ldap.so.1 use_first_pass debug
rsh auth sufficient pam_rhosts_auth.so.1
rsh auth binding pam_unix_auth.so.1 server_policy
rsh auth required pam_ldap.so.1 use_first_pass debug
ppp auth requisite pam_authtok_get.so.1
ppp auth required pam_dhkeys.so.1
ppp auth binding pam_unix_auth.so.1 server_policy
ppp auth required pam_dial_auth.so.1
ppp auth required pam_ldap.so.1 use_first_pass debug
dtsession auth requisite pam_authtok_get.so.1
dtsession auth required pam_dhkeys.so.1
dtsession auth binding pam_unix_auth.so.1 server_policy
dtsession auth required pam_ldap.so.1 debug
other auth requisite pam_authtok_get.so.1 debug
other auth sufficient pam_dhkeys.so.1 debug
other auth binding pam_unix_cred.so.1
other auth binding pam_unix_auth.so.1 server_policy debug
other auth required pam_ldap.so.1 use_first_pass debug
passwd auth required pam_passwd_auth.so.1 debug server_policy
cron account required pam_projects.so.1
cron account required pam_unix_account.so.1
dtlogin account requisite pam_roles.so.1
dtlogin account required pam_projects.so.1
dtlogin account binding pam_unix_account.so.1 server_policy
dtlogin account required pam_ldap.so.1 debug
ppp account requisite pam_roles.so.1
ppp account required pam_projects.so.1
ppp account required pam_unix_account.so.1 server_policy
other account requisite pam_roles.so.1
other account required pam_projects.so.1
other account binding pam_unix_account.so.1 server_policy
other account required pam_ldap.so.1 debug
ppp session required pam_unix_session.so.1
other session required pam_unix_session.so.1
other session required pam_mkhomedir.so.1 skel=/etc/skel umask=0022
other password required pam_dhkeys.so.1 debug
other password requisite pam_authtok_get.so.1 debug
other password requisite pam_authtok_check.so.1 debug
other password sufficient pam_authtok_store.so.1 server_policy debug
other password required pam_ldap.so.1 debug
The issue we are having is that the DS is configured to force a password change after an administrator reset. If we change the lines:
other account binding pam_unix_account.so.1 server_policy
other account required pam_ldap.so.1 debug
to
other account binding pam_ldap.so.1 debug
other account required pam_unix_account.so.1 server_policy
we get the prompt to change the password. But at that point a non-root user can not su to any other user.
Does anyone have any ideas? Also, we are trying to configure a Linux client to do the same thing, but can't get the system-auth file correct either.
Edited by: jason.hershcopf on Apr 2, 2009 6:32 PM

Answer 1

Hi Jason,
Wondering if you got an answer for this. I am having similiar issues with LDAP on Solaris 10.
Any feedback will be of great help.
Thanks!