likewise-open users with migrated home directory won’t decrypt automatically

This has to do with the pam stack. It could either be an incompatibility with pam_ecryptfs and whatever pam module likewise-open uses, or perhaps just a missing bit of pam configuration in the /etc/pam.d stack.

Subscribing Steve Langasek... Any ideas, Steve?

I agree it probably has to do with the pam stack. What do /etc/pam.d/common-auth and /etc/pam.d/common-session look like on the affected system?

Just a stock, default config with those modules installed.

common-auth:
# here are the per-package modules (the "Primary" block)
auth [success=2 default=ignore] pam_unix.so nullok_secure
auth [success=1 default=ignore] pam_lsass.so try_first_pass
# here's the fallback if no module succeeds
auth requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth required pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth optional pam_ecryptfs.so unwrap
auth optional pam_cap.so
# end of pam-auth-update config

common-session:

# here are the per-package modules (the "Primary" block)
session [default=1] pam_permit.so
# here's the fallback if no module succeeds
session requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
session required pam_permit.so
# The pam_umask module will set the umask according to the system default in
# /etc/login.defs and user settings, solving the problem of different
# umask settings with different shells, display managers, remote sessions etc.
# See "man pam_umask".
session optional pam_umask.so
# and here are more per-package modules (the "Additional" block)
session required pam_unix.so
session sufficient pam_lsass.so
session optional pam_ecryptfs.so unwrap
session optional pam_ck_connector.so nox11
# end of pam-auth-update config

And now I see the problem, even. It’s in common-session:

session sufficient pam_lsass.so
session optional pam_ecryptfs.so unwrap

…it never gets to the pam_ecryptfs.so because pam_lsass is sufficient.

This also partly explains why consolekit stuff doesn’t work properly for these users.

ok, looks like a bug in the likewise-open package then. reassigning.

Thanks, all! I'm actually going to re-add the ecryptfs-utils task and
mark it invalid there, as this question has come up more than once.
Hopefully that will make this more discoverable.