Customers have configured their SSR Conductor to support LDAP authentication. Authentication via LDAP is working fine for most users, however, there is a small group of users that are unable to successfully authenticate.

The following entries are found in the journal log:

May 20 11:40:53 conductor dredd[6739]: pam_unix(login:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=@ user=test-user
May 20 11:40:53 conductor dredd[6739]: pam_succeed_if(login:auth): requirement "uid >= 1000" not met by user "test-user"
May 20 11:40:53 conductor audispd[9570]: node=conductor type=USER_AUTH msg=audit(1716219653.595:610069903): pid=6739 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication grantors=? acct="test-user" exe="/usr/libexec/dredd" hostname=@ addr=? terminal=? res=failed'

On the LDAP server this user and the others experiencing problems happen to have a uid of less than 1000, whereas successful logins have a uid of greater than 1000. The test user for this logging had the following values associated with it on the ldap side:
gidNumber: 638
uid: test-user2
uidNumber: 638
homeDirectory: /home/test-user

This correlates with the OS user information below.

Nonworking user:

[conductor ~]$ id test-user uid=638(test-user) gid=638(test-user) groups=638(test-user),190(systemd-journal),1002(128t-admin)

Working user:

[conductor ~]$ id test-user2 uid=20012(test-user2) gid=20020(test-user2) groups=20020(test-user2),190(systemd-journal),1002(128t-admin)

The actual failure is originating from the /etc/pam.d/system-auth-ac file where the uid <> value of 1000 is tested.

Authentication via LDAP is working fine for most users, however, there is a small group of users that are unable to successfully authenticate.

This is a Linux system limitation. There are no guarantees in Centos that 500-1000 will not be used by an internal system user. The limit of <500 is an older one that has been increased in many Operating Systems to 1000 for this reason.

There are some compelling reasons to keep the limit at the same level as the base OS and there are other assumptions in the product (eg: how we manage uids <1000 vs above), so it is not supported to have the lower uids configured for SSR users on the LDAP side.