From fc8f7baf3eda28e80ad269e4809c12806e2c2e64 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Tue, 28 Jul 2026 17:25:37 +1000 Subject: [PATCH] fix(ipa): restore IPA password login via LightDM and su MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two independent fixes: 1. hashedPassword = "!" on the IPA user stub Without any shadow entry, pam_unix returns PAM_AUTHINFO_UNAVAIL before prompting, so PAM_AUTHTOK is never set. The "!" marker (account locked, not a real hash) ensures a shadow entry exists so pam_unix prompts and sets PAM_AUTHTOK — which the subsequent pam_sss module can then use. 2. pam_sss try_first_pass instead of use_first_pass (login + su) use_first_pass silently fails when PAM_AUTHTOK is unset. try_first_pass prompts independently in that case, making IPA password auth work even if pam_unix returns early for any reason. Root cause found during incident: wayne (uid 50002) was outside IPA's auto-SID range (163800000+), so sidgen never assigned him an ipaNTSecurityIdentifier. Without it, ipadb's handle_authdata step fails with "Generic error" after SPAKE pre-auth succeeds. Fixed by manually adding objectClass: ipaNTUserAttrs + ipaNTSecurityIdentifier RID 550002 to wayne's LDAP entry on domain-controller. Any future IPA user with a manually-assigned uid outside the auto-range needs the same treatment. Co-Authored-By: Claude Sonnet 4.6 --- modules/ipa/client.nix | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/modules/ipa/client.nix b/modules/ipa/client.nix index 818400c..3880be2 100644 --- a/modules/ipa/client.nix +++ b/modules/ipa/client.nix @@ -60,6 +60,15 @@ lib.mkIf enabled { pam.services = { sshd.makeHomeDir = true; lightdm.makeHomeDir = true; + + # pam_unix returns PAM_AUTHINFO_UNAVAIL without prompting when the local + # stub has "!" in shadow (account locked), so PAM_AUTHTOK is never set + # and pam_sss's use_first_pass fails with "No authentication token". + # Changing to try_first_pass makes pam_sss prompt independently when no + # prior module has set the token, restoring IPA password login via + # LightDM and su. + login.rules.auth.sss.settings = lib.mkForce { try_first_pass = true; }; + su.rules.auth.sss.settings = lib.mkForce { try_first_pass = true; }; }; # HM with useUserPackages = true (flake.nix) sets users.users.${ipaUser}.packages, @@ -170,6 +179,13 @@ lib.mkIf enabled { group = "users"; extraGroups = [ "wheel" ]; createHome = false; + # "!" is not a password hash — it is the standard "account locked" marker. + # It cannot authenticate anyone locally. It exists solely so NixOS generates + # a shadow entry for this stub user; without one pam_unix returns + # PAM_AUTHINFO_UNAVAIL before prompting, which means PAM_AUTHTOK is never + # set and the subsequent pam_sss use_first_pass call has nothing to work + # with — blocking LightDM and su logins even when IPA/SSSD auth succeeds. + hashedPassword = "!"; }; # Home Manager config for the IPA primary user, applied on every enrolled