Authentication Failure PAM/LDAP

Bug #1211084 reported by gitouttahere
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
percona-pam-for-mysql
New
Undecided
Unassigned

Bug Description

I'm having significant trouble getting db authentication to function. I try to log into a phpMyAdmin interface using ldapuser1 or ldapuser2 and It's like it tries but can't seem to make it happen. Could someone help point me in the right direction to get this functional?

Overview
1) I have a server setup to authenticate against a 389 LDAP server.
2) The SSH session authentication works. i.e. I'm able to log in via LDAP credentials to a shell.
3) I've compiled the plugin successfully and loaded it into MySQL.
4) I've added pam.d/ entries as specified.
5) I've attempted to use the auth_pam and auth_pam_compat options.
5) I've restarted services and rebooted the server.

NOTE: any information deemed sensitive has been modified to remove it but keep the messages intact otherwise.

In the end I continue to get the following errors in auth.log:

Aug 11 17:01:45 dbhost mysqld[2554]: pam_unix(mysqld:auth): conversation failed
Aug 11 17:01:45 dbhost mysqld[2554]: pam_unix(mysqld:auth): auth could not identify password for [ldapuser1]

My setup is as follows:

{ /etc/pam.d/mysqld contents }

# Standard Un*x authentication.
auth required pam_warn.so
auth required pam_unix.so audit
account required pam_unix.so audit

{ MySQL Lib Directory Contents }

root@dbhost:/etc/pam.d# ls /usr/lib/mysql/plugin/
adt_null.so auth_pam.so dialog.la mypluglib.so semisync_master.so
auth_pam_compat.la auth.so dialog.so qa_auth_client.so semisync_slave.so
auth_pam_compat.so auth_socket.so ha_example.so qa_auth_interface.so test_auth_pam_client.la
auth_pam.la auth_test_plugin.so libdaemon_example.so qa_auth_server.so test_auth_pam_client.so

{ MySQL Plugin Info }

mysql> show plugins;
+--------------------------+----------+--------------------+--------------------+---------+
| Name | Status | Type | Library | License |
+--------------------------+----------+--------------------+--------------------+---------+
| binlog | ACTIVE | STORAGE ENGINE | NULL | GPL |
| mysql_native_password | ACTIVE | AUTHENTICATION | NULL | GPL |
| mysql_old_password | ACTIVE | AUTHENTICATION | NULL | GPL |
| MEMORY | ACTIVE | STORAGE ENGINE | NULL | GPL |
| MyISAM | ACTIVE | STORAGE ENGINE | NULL | GPL |
| CSV | ACTIVE | STORAGE ENGINE | NULL | GPL |
| MRG_MYISAM | ACTIVE | STORAGE ENGINE | NULL | GPL |
| InnoDB | ACTIVE | STORAGE ENGINE | NULL | GPL |
| INNODB_TRX | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_LOCKS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_LOCK_WAITS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMP | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMP_RESET | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMPMEM | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_CMPMEM_RESET | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_BUFFER_PAGE | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_BUFFER_PAGE_LRU | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| INNODB_BUFFER_POOL_STATS | ACTIVE | INFORMATION SCHEMA | NULL | GPL |
| BLACKHOLE | ACTIVE | STORAGE ENGINE | NULL | GPL |
| ARCHIVE | ACTIVE | STORAGE ENGINE | NULL | GPL |
| FEDERATED | DISABLED | STORAGE ENGINE | NULL | GPL |
| PERFORMANCE_SCHEMA | ACTIVE | STORAGE ENGINE | NULL | GPL |
| partition | ACTIVE | STORAGE ENGINE | NULL | GPL |
| auth_pam | ACTIVE | AUTHENTICATION | auth_pam.so | GPL |
| auth_pam_compat | ACTIVE | AUTHENTICATION | auth_pam_compat.so | GPL |
+--------------------------+----------+--------------------+--------------------+---------+

{ MySQL access to the shadow file }

root@dbhost:/etc/pam.d# cat /etc/group |grep shadow
shadow:x:42:mysql

root@dbhost:/etc/pam.d# ll /etc/shad*
-rw-r----- 1 root shadow 863 Jun 29 14:55 /etc/shadow

{ General results of getent call to check LDAP connectivity }

root@dbhost:/etc/pam.d# getent passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
Debian-exim:x:101:103::/var/spool/exim4:/bin/false
statd:x:102:65534::/var/lib/nfs:/bin/false
sshd:x:103:65534::/var/run/sshd:/usr/sbin/nologin
ntp:x:104:106::/home/ntp:/bin/false
mysql:x:105:107:MySQL Server,,,:/nonexistent:/bin/false
ldapuser1:*:5000:5000:LDAP USER:/home/ldapuser1:/bin/bash
ldapuser2:*:5001:5001:LDAP USER:/home/ldapuser2:/bin/bash

{ I've used the following reference sites for setup or troubleshooting }

http://www.heitorlessa.com/mysql-pam-and-active-directory-authentication/
http://www.percona.com/doc/percona-pam-for-mysql/manual.html

Revision history for this message
gitouttahere (tcrass) wrote :

Anyone have any ideas about this?

Revision history for this message
gitouttahere (tcrass) wrote :

Still hoping for any feedback on this bugger if anyone has it.

Revision history for this message
Sergei Glushchenko (sergei.glushchenko) wrote :
Revision history for this message
Sergei Glushchenko (sergei.glushchenko) wrote :

Something goes wrong in client-server communication, I suspect that your PHP cannot load required client plugin.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.