[OpenAFS] pam_gssklog with gdm

[Stephen Pearson]

I'm trying to get OpenAFS to work on Linux with pam_gssklog and using 
a Windows 2003 server KDC.  I seem to be getting pretty close, but I
can't get gdm to log me in.

So far I can login via SSH or on the console using my Windows principal
password, and I see my TGT and afs token as expected.  However gdm login
always fails and complains that it can't write to
"~/.gconf-test-locking-file".  Syslog contains the following messages :

Oct  1 16:45:19 rit-scan gdm(pam_unix)[3921]: check pass; user unknown
Oct  1 16:45:19 rit-scan gdm(pam_unix)[3921]: authentication failure;
logname= uid=0 euid=0 tty=:0 ruser=gdm rhost=localhost
Oct  1 16:45:19 rit-scan gdm-binary[3921]: pam_gssklog:
pam_sm_authenticate:called
Oct  1 16:45:19 rit-scan gdm-binary[3921]: pam_krb5: authentication
succeeds for `stephen'
Oct  1 16:45:19 rit-scan gdm-binary[3921]: pam_gssklog:
pam_sm_setcred:called
Oct  1 16:45:19 rit-scan gdm(pam_unix)[3921]: session opened for user
stephen by (uid=0)
Oct  1 16:45:19 rit-scan gdm[3921]: gdm_slave_session_start: Directory
/afs/hpl.hp.com/home/stephen/.gnome2 does not exist.

Here's the auth section of my system-auth PAM config (I'm using nss
LDAP as well).  For some reason, I have to add pam_gssklog before
pam_krb5 or I don't get my AFS token.

auth        required      /lib/security/$ISA/pam_env.so
auth        sufficient    /lib/security/$ISA/pam_unix.so likeauth nullok
auth        optional      /lib/security/$ISA/pam_gssklog.so.1 debug
auth        sufficient    /lib/security/$ISA/pam_krb5.so try_first_pass
auth        sufficient    /lib/security/$ISA/pam_ldap.so use_first_pass
auth        required      /lib/security/$ISA/pam_deny.so

I have managed to make this work (including gdm) using pam_krb5afs
against an MIT kerberos KDC running a krb524 service, but Win 2003
only supports v5 tickets and gssklog seems to be the way to go.

It looks like pam_sm_setcred gets called, so maybe gdm doesn't set
the PAG correctly?

I'm using Red Hat 9, openafs-1.2.10, gssklog-0.10.

Anybody managed this before?

Thanks.
Steve.

-- 
[(hp)]   : Stephen Pearson <stephen@hp.com>
invent   : RIT Platforms, HP Labs Bristol, UK