LFCS · Question #132
After finishing configuring of a Unix client to authenticate with a Microsoft Active Directory server, login attempts are unsuccessful. Which of the following is most likely the cause?
The correct answer is B. The PAM library is searching the directory with the default search filter. When a Unix client fails to log in after being configured to authenticate with Microsoft Active Directory, the most likely cause is an incorrect search filter used by the PAM library.
Question
Options
- AUnix Client support is disabled in the Active Directory configuration.
- BThe PAM library is searching the directory with the default search filter.
- CThe slapd daemon is not running.
- DThe user account in Active Directory has the remote login setting disabled.
How the community answered
(38 responses)- A5% (2)
- B82% (31)
- C11% (4)
- D3% (1)
Why each option
When a Unix client fails to log in after being configured to authenticate with Microsoft Active Directory, the most likely cause is an incorrect search filter used by the PAM library.
While Active Directory has various configuration settings, there is no single 'Unix Client support' disabled setting that would universally prevent authentication.
Unix clients often expect specific LDAP attributes like `uid` or `cn` for usernames, but Active Directory primarily uses `sAMAccountName`; if PAM's search filter is not configured to map or query using AD's specific attribute, user lookups and authentication will fail.
The `slapd` daemon is the OpenLDAP server process and is not running on the Microsoft Active Directory server or the Unix client for authentication against AD.
Active Directory user accounts do not have a specific 'remote login setting' that would typically prevent a properly configured Unix client from authenticating via LDAP.
Concept tested: Unix/PAM integration with Active Directory LDAP
Source: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc782333(v=ws.10)
Topics
Community Discussion
No community discussion yet for this question.