I'm attempting to set up LDAP authentication according to the instructions in Sander Van Vugt's RHCSA/RHCE book for RHEL7. In chapter 6 he explains that when using authconfig-tui the FORCELEGACY option is set to yes in /etc/sysconfig/authconfig. This is supposed to configure nslcd instead of sssd.I do not see this happening. Perhaps it was that way in 7.0 or even 7.1, but in 7.3 the option is set to no after using authconfig-tui.If I put aside the nslcd vs sssd confusion and attempt the complete the exercise which leads to running su - lara to authenticate via LDAP to said user, I merely get:su: user lara does not existI've verified that the FreeIPA server is answering queries using ldapsearch and in doing so, confirmed that the user is in LDAP. It seems to me, though, that su is not authenticating against LDAP, but instead /etc/passwd.My PAM system-auth configuration includes the sssd entries that seem to be necessary:auth        sufficient    pam_sss.so forward_passaccount     [default=bad success=ok user_unknown=ignore] pam.sss.sopassword    sufficient    pam_sss.so use_authtoksession     optional      pam_sss.soMy /etc/nsswitch.conf file contains:passwd:    files sssshadow:    files sssgroup:     files sssThe sssd service is active.There aren't any log entries in /var/log/* or /var/log/sssd/*. In fact, none of the sssd logs contains anything.EDITAfter some reading I'm still no closer to a solution to this, however, I do have more information.I am able to authenticate as user lara if I ssh into the LDAP server. So I know that LDAP is actually working.I also looked at the PAM config for su. This is pulling in the system-auth file:auth        substack        system-authaccount     include         system-authpassword    include         system-authsession     include         system-authso it should be making use of the pam_sss.so module implicitly.Still can't sort it out, though.EDIT 2Being able to log into the IPA server either locally or via SSH with user lara, I decided to compare the pam files on it with those on the client. The only difference I was able to determine is that the client contained broken_shadow with the pam_unix.so account entry. I removed it and even rebooted but it didn't fix anything.How do I disable broken_shadow? I can't find anything about it.
LDAP user does not exist when running 'su'
rhel;ldap;sssd