ODBC/JDBC Auth on openSUSE running PAM/SSSD
Posted in 2017
Good day Informix gurus,
I am looking for help polishing off a configuration with our new IDS instance.
O/S: openSUSE Leap 42.1
IDS: 12.10.xC7
CSDK: 4.xxx
User authentication has been configured so that most users get authed against
the AD.
I can't seem to figure out what needs to be done so that my configuration
authenticates user logins successfully.
I am including the following file excerpts from the different configuration
and log files related to this situation:
*** Excerpt from $INFORMIXDIR/etc/$ONCONFIG file:
SERVERNUM 200
DBSERVERNAME dmart0DBSERVERALIASES dmart0prim,dmart0pam
*** Excerpt from $INFORMIXDIR/etc/sqlhosts file:
dmart0 onipcshm phoenix2.cantrexnw.local online_dmart0
g_dmart0 group - - e=dmart0secdmart0prim onsoctcp phoenix2.cantrexnw.local on_dmart0prim g=g_dmart0
dmart0sec onsoctcp DRPPhoenix on_dmart0sec g=g_dmart0
dmart0pam onsoctcp phoenix2.cantrexnw.local on_dmart0pam
s=4,pam_serv=(informix),pamauth=(password)
*** Contents of the /etc/pam.d/informix file
auth sufficient pam_sss.so
auth required pam_unix.so debug
#
account sufficient pam_sss.so
account sufficient pam_localuser.so debug
account required pam_unix.so debug
Trying to connect to the database server using the SDK's Connect Test Demo
interface, I get the following error displayed on the client side
ERROR [08004][Informix][Informix ODBC Driver][Informix] Server rejected the
connection.
and the corresponding logged error(s) can be found in the following
/var/log/messages excerpt
*** Excerpt from /var/log/messages
2017-05-15T15:00:04.644047-04:00 phoenix2 oninit: pam_sss(informix:auth):
authentication failure; logname= uid=1001 euid=0 tty= ruser=entrepot
rhost=cantrexbi.cantrexnw.local user=entrepot
2017-05-15T15:00:04.645713-04:00 phoenix2 oninit: pam_sss(informix:auth):
received for user entrepot: 10 (User not known to the underlying
authentication module)
2017-05-15T15:00:04.657913-04:00 phoenix2 oninit: pam_unix(informix:auth):
authentication failure; logname= uid=1001 euid=0 tty= ruser=entrepot
rhost=cantrexbi.cantrexnw.local user=entrepot
I believe that I have tried many combinations so far and I can't seem to
determine why AD users are denied access when connecting through a
client-server connection.
SSH connections work fine (even though they get authenticated through AD and
SSSD but I can't seem to find the right settings to get the Informix PAM
connections working.
Any help would be greatly appreciated.
Daniel Dansereau
Systemes Logikinfo Inc.
daniel.dansereau@logikinfo.com
+1 514-262-3166