user failed to login after LDAP-UX setup

[Binbin_1]

I setup the LDAP-UX with IBM Tivoli Directory Server.

Now I can su to an ldap user but the ldap user cannot login to the HP-UX by his own.

HP-UX tivhp12 B.11.11 U 9000/800 (te)
login: ldapuser
Password:
Your account has expired or has been locked.

Log infomations as follows:
Jan 9 16:35:41 tivhp12 login: pam_authenticate: error Authentication failed
Jan 9 16:35:41 tivhp12 login: PAM_LDAP Entering pam_sm_authenticate ...
Jan 9 16:35:41 tivhp12 login: PAM_LDAP pam_sm_authenticate(login, ldapuser), flags = 0
Jan 9 16:35:41 tivhp12 login: PAM_LDAP auth-bind authenticate passed!
Jan 9 16:35:41 tivhp12 login: PAM_LDAP pam_sm_authenticate: set bind status (0)
Jan 9 16:35:41 tivhp12 login: PAM_LDAP 1st auth_bind returns 0
Jan 9 16:35:41 tivhp12 login: PAM_LDAP pam_sm_authenticate: returning 0
Jan 9 16:35:41 tivhp12 login: PAM_LDAP Entering pam_sm_authenticate ...
Jan 9 16:35:41 tivhp12 login: PAM_LDAP pam_sm_authenticate(login, ldapuser), flags = 0
Jan 9 16:35:41 tivhp12 login: PAM_LDAP auth-bind authenticate passed!
Jan 9 16:35:41 tivhp12 login: PAM_LDAP pam_sm_authenticate: set bind status (0)
Jan 9 16:35:41 tivhp12 login: PAM_LDAP 1st auth_bind returns 0
Jan 9 16:35:41 tivhp12 login: PAM_LDAP pam_sm_authenticate: returning 0
Jan 9 16:35:41 tivhp12 login: pam_acct_mgmt: error User account has expired
Jan 9 16:35:41 tivhp12 login: exiting with return code 17
Jan 9 16:39:44 tivhp12 login: pam_authenticate: error Authentication failed

nsquery works fine:
bash-3.1# nsquery passwd ldapuser

Using "files ldap" for the passwd policy.

Searching /etc/passwd for ldapuser
ldapuser was NOTFOUND

Switch configuration: Allows fallback

Searching ldap for ldapuser
User name: ldapuser
User Id: 116
Group Id: 20
Gecos:
Home Directory: /home/ldapuser
Shell: /sbin/sh

Switch configuration: Terminates Search

It seems pam searched the expire attribute for the user which actually doens't exist.

Is there any way to disable the expiration check or anything I can change on the directory server to meet the requirements?

Thank you in advance!

[Robert-Jan Goossens]

Hi,

Did you configure ldap in the /etc/nsswitch.conf?

http://docs.hp.com/en/J4269-90016/ch02s07.html

Regards,
Robert-Jan

[Binbin_1]

Sure.
The currrent /etc/nsswitch.conf:

passwd: files ldap
group: files ldap
hosts: dns files ldap
networks: files ldap
protocols: files ldap
rpc: files ldap
publickey: ldap [NOTFOUND=return] files
netgroup: files ldap
automount: files ldap
aliases: files
services: files ldap

As you can see in my first post, the nsquery command works fine.

[Binbin_1]

Finally I found the root cause was the incorret pam.conf..
I did some copy&paste work in pam.conf and some lines were incorrect.