<HTML>
<HEAD>
<TITLE>Re: [389-users] PAM PTA partially working</TITLE>
</HEAD>
<BODY>
<FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'>Rich,<BR>
<BR>
Andrey’s suggestion worked. Yes, I have enabled SSL in the Admin server and Directory Server. But it still would fall back on 389-ds password, when “pamsecure=TRUE’. If I set pamsecure=FALSE, the authentication passed through to the AD as intended.<BR>
<BR>
How do I secure the communication between 389-ds and LDAP server? I used wireshark to capture packets, and it’s all clear.<BR>
<BR>
<BR>
<BR>
</SPAN></FONT><BLOCKQUOTE><FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'><BR>
To revisit, here's the observation: pamsecure when set to TRUE authenticates<BR>
users only to the password in 389-ds, but when set to FALSE will<BR>
authenticate to the AD password only if the uid exists in /etc/passwd.<BR>
</SPAN></FONT><FONT SIZE="2"><FONT FACE="Consolas, Courier New, Courier"><SPAN STYLE='font-size:10pt'> <BR>
</SPAN></FONT></FONT></BLOCKQUOTE><FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'>That's really bizarre - the only place where pamSecure is used is here:<BR>
if (cfg->pamptconfig_secure) { /* is a secure connection required? */<BR>
int is_ssl = 0;<BR>
slapi_pblock_get(pb, SLAPI_CONN_IS_SSL_SESSION, &is_ssl);<BR>
if (!is_ssl) {<BR>
</SPAN></FONT><FONT SIZE="2"><FONT FACE="Consolas, Courier New, Courier"><SPAN STYLE='font-size:10pt'> slapi_log_error( SLAPI_LOG_PLUGIN, PAM_PASSTHRU_PLUGIN_SUBSYSTEM, "<= connection not secure (secure connection required; check config)"); <BR>
</SPAN></FONT></FONT><FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'> return retcode;<BR>
}<BR>
}<BR>
</SPAN></FONT><FONT SIZE="2"><FONT FACE="Consolas, Courier New, Courier"><SPAN STYLE='font-size:10pt'>That is, if pamSecure is true, requests will be rejected unless using TLS/SSL. Do you have your directory server configured to use TLS/SSL when using pamSecure: TRUE?</SPAN></FONT></FONT>
</BODY>
</HTML>