PowerBroker (Likewise-Open) + Ubuntu 13.04 -> 13.10 Upgrade

Question

I just upgraded Ubuntu from 13.04 to 13.10, and now I can't log into Active Directory; my system is integrated using PowerBroker Identity Services (PBIS), which used to be called Likewise-Open.

So far I have identified the following symptoms:

• I am able to log in with my credentials via ssh.
• The screen goes black when attempting log into my account via the login screen.

I've tried leaving the domain, purging PBIS, and re-installing the latest version of PBIS. I've been trying the troubleshooting section I found here, but I haven't had any success.

The relevant portion of the auth.log

Oct 22 09:30:26 mypc lightdm: pam_succeed_if(lightdm:auth): requirement "user ingroup nopasswdlogin" not met by user "myusername"
Oct 22 09:30:29 mypc lightdm: pam_unix(lightdm-greeter:session): session closed for user lightdm
Oct 22 09:30:29 mypc lightdm: pam_unix(lightdm:session): session opened for user myusername by (uid=0)
Oct 22 09:30:29 mypc lightdm: pam_unix(lightdm:session): session closed for user myusername
Oct 22 09:30:30 mypc lightdm: pam_unix(lightdm-greeter:session): session opened for user lightdm by (uid=0)
Oct 22 09:30:30 mypc systemd-logind[718]: New session c5 of user lightdm.
Oct 22 09:30:30 mypc lightdm: pam_ck_connector(lightdm-greeter:session): nox11 mode, ignoring PAM_TTY :1
Oct 22 09:30:31 mypc dbus[535]: [system] Rejected send message, 2 matched rules; type="method_call", sender=":1.129" (uid=110 pid=5139 comm="/usr/lib/x86_64-linux-gnu/indicator-keyboard-servi") interface="org.freedesktop.DBus.Properties" member="GetAll" error name="(unset)" requested_reply="0" destination=":1.39" (uid=0 pid=2024 comm="/usr/sbin/console-kit-daemon --no-daemon ")

My .xsession-errors log

Script for ibus started at run_im.
Script for auto started at run_im.
Script for default started at run_im.
/usr/sbin/lightdm-session: 5: exec: init: not found

Solution

I found this bug: https://bugs.launchpad.net/ubuntu/+source/likewise-open/+bug/1162836

I had the same problem where after I finally logged in, my $PATH variable was a ways off from what the local user. Per that bug, I updated /etc/pam.d/common-session and made the following change the line:

session sufficient pam_lsass.so

to:

session [success=ok default=ignore] pam_lsass.so

I did not need to create the symlinks to init as a workaround either after making this change. I am now able to successfully log in as my Active Directory user with PBIS 7.5.2

Comments

[pl44]

pam_lsass.s should be pam_lsass.so (obviously). Thanks Mike, worked like a charm!

[pl44]

After applying the fix, unbinding from AD recognizes that the PAM configuration was manually edited and asks the user if he wants the system to administer the configuration, or if he would like to do so manually going forward. This question is only asked when programs attempt to edit the PAM configuration file, so there typically won't be any issues applying this fix. Just remember (after the bug gets fixed) that you want the system to handle the configuration when it asks.