Archived
beatzaplentyandClaude Sonnet 4.6
fc8f7baf3e
Check NixOS configurations / eval-hosts (pull_request) Successful in 10m33s
Two independent fixes: 1. hashedPassword = "!" on the IPA user stub Without any shadow entry, pam_unix returns PAM_AUTHINFO_UNAVAIL before prompting, so PAM_AUTHTOK is never set. The "!" marker (account locked, not a real hash) ensures a shadow entry exists so pam_unix prompts and sets PAM_AUTHTOK — which the subsequent pam_sss module can then use. 2. pam_sss try_first_pass instead of use_first_pass (login + su) use_first_pass silently fails when PAM_AUTHTOK is unset. try_first_pass prompts independently in that case, making IPA password auth work even if pam_unix returns early for any reason. Root cause found during incident: wayne (uid 50002) was outside IPA's auto-SID range (163800000+), so sidgen never assigned him an ipaNTSecurityIdentifier. Without it, ipadb's handle_authdata step fails with "Generic error" after SPAKE pre-auth succeeds. Fixed by manually adding objectClass: ipaNTUserAttrs + ipaNTSecurityIdentifier RID 550002 to wayne's LDAP entry on domain-controller. Any future IPA user with a manually-assigned uid outside the auto-range needs the same treatment. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>