Bugzilla – Bug 139338
updating KDM/GDM configuration after pam_winbind set for authentication
Last modified: 2006-03-01 08:11:24 UTC
After yast2-samba-client sets the authentication (not sure if only in case of Active Directory or general for pam_winbind), KDM/GDM config needs to be updated to reflect this situation (to be able to show the winbind greeter). The implementation must be done in yast2-samba-client, but I don't know what is necessary to do.
(adding GNOME: Ralf says it is not available for GDM - Stanislav, do you want to do something about it?)
in any case: yast2 will have to change /etc/sysconfig/displaymanager and SuSEconfig will write the kdmrc. Not sure if something like setting KDM_GREETER to winbind (or empty if default) is enough for this.
well, so what should yast write there?
can't tell you right now. Ask Ralf I guess
AFAIK, GDM has no winbind domain selection in their greeters. There are two levels for modifying gdm behavior: - Show message and ask for domain as an additional question in PAM (text-only dialog, could work in console login). - Change greeter in /etc/opt/gnome/gdm/gdm.conf (variables Greeter and RemoteGreeter). If you are able to test, whether your greeter communicates with gdm, I can update greeter from sysconfig. But in general it's bad to use KDM_GREETER - if you have both GNOME and KDE backends, it should be possible to select different one for kdm and different one for gdm. GDM_GREETER KDM_GREETER GREETER # fallback, if XXX_GREETER is not set. # If none is set, use default greeter from the package.
For KDM the follwing adjustments would have to be made to kdmrc if (KDM_)GREETER == winbind: 1. Set PluginsLogin and PluginsShutdown to windbind 2. If feature #300371 is not going to be ready for NLD10 add winbind.Domains=<domain> to the PluginOptions key 3. If feature #300372 add winbind.Separator=\ (or whatever the current separator is to the PluginOptions key. 4. If the winbind greeter can't be integrated into the current KDM theme (Feature #300373) some other adjustments might be needed (e.g. color, background, ...)
This looks like yast2 module has to do only one thing: write "winbind" value to KDM_GREETER in /etc/sysconfig/displaymanager and run SuSEconfig. The rest should be done by SuSEconfig script for kdm. Stephan, please add a desctiption for KDM_GREETER to /etc/sysconfig/displaymanager and take care of the rest of settings.
I decided to go a bit less kdm specific. Please add a "yes" there for winbind, the rest will be done in SuSEconfig ## Type: yesno ## Default: no # # Display a combobox for AD domains # DISPLAYMANAGER_AD_INTEGRATION=""
Done. Assuming only KDM can currently handle this, I run kdm3 SuSEconfig module after saving /etc/sysconfig/displaymanager. Let me know when GDM gets ready, so I can enhance yast behaviour.
Reopening for GDM.
OK, now YaST calls also "gdm" SuSEconfig module :-). But I think GDM still is not able to show the greeter -> sbrabec.
Setting to NEEDINFO: I don't have any experience with AD and cannot test. Could you try to edit /etc/opt/gnome/gdm/gdm.conf, change greeter/remote greeter there and let me know, whether it works with gdm? If it does not work, we need a different solution (e. g. PAM module or so).
I don't know
HPJ, what is the setting for gdm?
In gdm.conf: Set the key "ShowDomain" in section "greeter" to "true". Set it back to "false" or comment it out to hide the domain selector. The latest gdm patch adds this option to gdm.conf, commented out. [greeter] ShowDomain=true
Note that the GDM theme must support domain selection. I have not yet committed changes to the NLD GDM theme.
The prerequisite changes for GDM and its theme are in autobuild since yesterday. sbrabec: See above messages from me on how to update GDM configuration.
DISPLAYMANAGER_AD_INTEGRATION implemented to SuSEconfig.gdm. To Stephan Kulow: Please change default to "no". Empty string is not allowed for yesno and user of YaST sysconfig editor cannot continue here without value change. ## Type: yesno ## Default: no # # Display a combobox for AD domains # DISPLAYMANAGER_AD_INTEGRATION=""
Reassigning. The fix for bug from comment #18 is also included in proposed patches in bug 148468.
done that