HP-UX

Hey,

I've asked questions about this project here before and gotten lots of help so I figured I'd give it another try.

I've recently set up my HP-UX environment to authenticate to a Windows Active Directory server (Windows Server 2003 R2).

I setup an account on Active Directory which works perfectly. I can log in, do everything, change passwords, etc. It all works. This is an account that exists on the AD SERVER ONLY.
I'm also trying to setup an account that exists locally on the HP-UX server AND on the AD server. In this case it's the root account but I'm also doing it for others.

Here's my problem:

I can authenticate to the HP server using the local root password no problem, but I can't log in with the Active Directory password.
If I try to change my password when I log in (or any attempt to make a kerberos service ticket), the account is automatically locked on the Active Directory server and I get this error message:

"kinit(v5): Clients credentials have been revoked while getting initial credentials"

Does anyone know why I can't get this to work with a local account as well as Active Directory? Does it have to do with implementing a Trusted System (Mine's a trusted system by the way)?

Just for info's sake here's my /etc/pam.conf file, but this shouldn't be the problem as authenticating to an AD only account works flawlessly:

#
# Authentication management
#
login auth sufficient /usr/lib/security/libpam_krb5.1
login auth required /usr/lib/security/libpam_unix.1 use_first_pass
su auth sufficient /usr/lib/security/libpam_krb5.1
su auth required /usr/lib/security/libpam_unix.1 use_first_pass
dtlogin auth sufficient /usr/lib/security/libpam_krb5.1
dtlogin auth required /usr/lib/security/libpam_unix.1 use_first_pass
dtaction auth sufficient /usr/lib/security/libpam_krb5.1
dtaction auth required /usr/lib/security/libpam_unix.1 use_first_pass
ftp auth sufficient /usr/lib/security/libpam_krb5.1
ftp auth required /usr/lib/security/libpam_unix.1 use_first_pass
OTHER auth sufficient /usr/lib/security/libpam_krb5.1
OTHER auth required /usr/lib/security/libpam_unix.1 use_first_pass
#
# Account management
#
login account sufficient /usr/lib/security/libpam_krb5.1
login account required /usr/lib/security/libpam_unix.1
su account sufficient /usr/lib/security/libpam_krb5.1
su account required /usr/lib/security/libpam_unix.1
dtlogin account sufficient /usr/lib/security/libpam_krb5.1
dtlogin account required /usr/lib/security/libpam_unix.1
dtaction account sufficient /usr/lib/security/libpam_krb5.1
dtaction account required /usr/lib/security/libpam_unix.1
ftp account sufficient /usr/lib/security/libpam_krb5.1
ftp account required /usr/lib/security/libpam_unix.1
sshd account required /usr/lib/security/libpam_authz.1
sshd account required /usr/lib/security/libpam_unix.1
sshd account sufficient /usr/lib/security/libpam_krb5.1
OTHER account sufficient /usr/lib/security/libpam_krb5.1
OTHER account required /usr/lib/security/libpam_unix.1
#
# Session management
#
login session required /usr/lib/security/libpam_krb5.1
login session required /usr/lib/security/libpam_unix.1
dtlogin session required /usr/lib/security/libpam_krb5.1
dtlogin session required /usr/lib/security/libpam_unix.1
dtaction session required /usr/lib/security/libpam_krb5.1
dtaction session required /usr/lib/security/libpam_unix.1
OTHER session required /usr/lib/security/libpam_krb5.1
OTHER session required /usr/lib/security/libpam_unix.1
#
# Password management
#
login password sufficient /usr/lib/security/libpam_krb5.1
login password required /usr/lib/security/libpam_unix.1 use_first_pass
passwd password sufficient /usr/lib/security/libpam_krb5.1
passwd password required /usr/lib/security/libpam_unix.1 use_first_pass
dtlogin password sufficient /usr/lib/security/libpam_krb5.1
dtlogin password required /usr/lib/security/libpam_unix.1 use_first_pass
dtaction password sufficient /usr/lib/security/libpam_krb5.1
dtaction password required /usr/lib/security/libpam_unix.1 use_first_pass
OTHER password sufficient /usr/lib/security/libpam_krb5.1
OTHER password required /usr/lib/security/libpam_unix.1 use_first_pass
OTHER password required /usr/lib/security/pam_sso.hp.1


Thank you very much for any help you can give,

Ryan

We are implementing Quest Vintela for all our HP-UX servers for AD signon.

Integrate Unix, Linux, and web platforms into Windows-based identity, access, policy, and management services with Vintela

it works pretty well, there were some issues, and MOST are resolved.

Ya I looked at that product a while back. We decided to use Windows Identity Management for Unix. Everything is working pretty well (at least on linux which is MUCH easier to configure for this) but just this one little problem I have above.

I've setup a similar environment to what I'm implementing now in a test environment and I had it working flawlessly so I know it's "possible". The only difference between the two environments is the HP-UX system is a trusted one in production.