I'm putting centralized authentication in my LAN infrastructure. The LDAP server is up and running, and all Debian/Ubuntu servers manage to authenticate users against the LDAP.
Now, all my CentOS8/Fedora32 machines just cannot. First, the client-side configuration is based on sssd, which differs a lot, but even then, once I've completed the client config, I can, typing
id $USER get all of the user's UID, GIDs, etc, so I know that the config is sane.
Now, from the newly-configured as root, let's say I do this:
# su - USER1 --> succeeds, without asking a passwd (of course), creates the home dir
# su - USER2 --> (as root, again), succeeds again
now... as USER2:
USER2$ su - USER1 --> will prompt for USER1's password, and will fail.
From any other machine:
ssh USER1@LDAPCLIENT --> fails
same for any other user.
This makes me think that there might be something in the way that RH-based machines interpret passwords, regardless of the backend. I'm no expert in PAM, SSSD or any security mechanism, so I do not know.
Anyone knows enough about SSSD, PAM, NSS on RH vs Debian to enlighten me ?