RSA PAM Authentication Agent cannot challenge users in Active Directory groups

Originally Published: 2018-04-26

Last Modified: 2023-11-30

Article Number

000041799

Applies To

RSA Product Set: SecurID
RSA Product/Service Type: Authentication Agent for PAM
RSA Version/Condition: 7.1.x
Platform: Linux

Issue

LDAP / Active Directory groups need to be challenged/unchallenged from the RSA PAM module, but PAM can't resolve these users.

Cause

The issue occurs because the getgrent() system call never returns the group entry.

Resolution

To resolve the issue, edit the /etc/sssd/sssd.conf file to include the line below.

enumerate = true

Notes

You may need to set the nesting level in the /etc/sssd/sssd.conf file to appear as shown below.

ldap_group_nesting_level = 2

Don't see what you're looking for?

Salesforce MFA Enforcement – Action Required