Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have LDAP authentication set up with SSSD and I can login fine through console and ssh. However when I try to login through KDM it just says authentication failure... More specifically:

Jan  9 10:29:11 adams20420 sssd[be[default]]: Failed to set LDAP SASL nocanon option to true. If your system is configured to use SASL, LDAP operations might fail.
Jan  9 10:29:24 adams20420 kdm: :1[4560]: PAM pam_parse: expecting return value; [...sufficeint]
Jan  9 10:29:24 adams20420 kdm: :1[4560]: PAM unable to dlopen(/lib64/security/ /lib64/security/ cannot open shared object file: No such file or directory
Jan  9 10:29:24 adams20420 kdm: :1[4560]: PAM adding faulty module: /lib64/security/
Jan  9 10:29:24 adams20420 kdm: :1[4560]: pam_ldap: ldap_starttls_s: Operations error
Jan  9 10:29:24 adams20420 kdm: :1[4560]: pam_unix(kde:auth): authentication failure; logname= uid=0 euid=0 tty=:1 ruser= rhost=  user=igierl1

Here is the pam.d/kdm

auth       required
auth       substack    system-auth
account    required
account    include     system-auth
password   include     system-auth
session    required
session    optional
session    optional force revoke
session    required
session    include     system-auth


auth            sufficient
auth            required
auth            required try_first_pass likeauth nullok
auth            optional

account         sufficient
account         required
account         optional

password        sufficeint
password        required difok=2 minlen=8 dcredit=2 ocredit=2 retry=3
password        required try_first_pass use_authtok nullok sha512 shadow
password        optional

session         required
session         required
session         required
session         optional
session         optional
share|improve this question
up vote 2 down vote accepted

You misspelled sufficient as sufficeint in /etc/pam.d/system-auth.

And you don't seem to be using sssd directly; you called instead of

share|improve this answer
The spelling suppressed one of the errors but the fixed the login issue. Thank you kind sir! – Drakkainen Jan 9 '14 at 21:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.