Using SSHA via pam_ldap on CentOS authenticating against ApacheDS

Question

I'm struggling to get CentOS to authenticate users via ApacheDS when the userPassword is encrypted with SSHA or SHA. Crypt works fine but due to restrictions of other services I really need this authd by SSHA.

Has anyone else had this problem? I'm sure I'm missing something but I can't see a value to set for allowing pam_ldap to authd by SSHA.

Cheers, -Ed

Answer 1

Sorry, I figured out what the problem was.

You can authenticate just fine using {crypt} in userPassword for a posixAccount even if you don't add in the relevant changes to /etc/pam.d/system-auth. I was thrown off by this.

Once I added:

auth        sufficient    pam_ldap.so use_first_pass
account     sufficient    pam_ldap.so
password    sufficient    pam_ldap.so ssha use_authtok use_first_pass
session     optional      pam_ldap.so

It worked just fine against {SHA} and {SSHA} encrypted userPassword in each posixAccount.

Also, oddly enough doing getent shadow <user> will only show the password if you have a {crypt} encrypted userPassword in the posixAccount. It never shows up for anything else.

Cheers, -Ed