RSA PAM Authentication Agent cannot challenge users in Active Directory groups
2 years ago
Originally Published: 2018-04-26
Article Number
000041799
Applies To
RSA Product Set: SecurID
RSA Product/Service Type: Authentication Agent for PAM
RSA Version/Condition: 7.1.x
Platform: Linux
Issue
LDAP / Active Directory groups need to be challenged/unchallenged from the RSA PAM module, but PAM can't resolve these users.
Cause
The issue occurs because the getgrent() system call never returns the group entry.
Resolution
To resolve the issue, edit the /etc/sssd/sssd.conf file to include the line below.
enumerate = true
Notes
You may need to set the nesting level in the /etc/sssd/sssd.conf file to appear as shown below.
ldap_group_nesting_level = 2