{"action":"created","issue":{"url":"https://api.github.com/repos/google/google-authenticator/issues/494","labels_url":"https://api.github.com/repos/google/google-authenticator/issues/494/labels{/name}","comments_url":"https://api.github.com/repos/google/google-authenticator/issues/494/comments","events_url":"https://api.github.com/repos/google/google-authenticator/issues/494/events","html_url":"https://github.com/google/google-authenticator/issues/494","id":69707450,"number":494,"title":"Authentication fails for LDAP users in Ubuntu","user":{"login":"Shellcat-Zero","id":5893998,"avatar_url":"https://avatars.githubusercontent.com/u/5893998?v=3","gravatar_id":"","url":"https://api.github.com/users/Shellcat-Zero","html_url":"https://github.com/Shellcat-Zero","followers_url":"https://api.github.com/users/Shellcat-Zero/followers","following_url":"https://api.github.com/users/Shellcat-Zero/following{/other_user}","gists_url":"https://api.github.com/users/Shellcat-Zero/gists{/gist_id}","starred_url":"https://api.github.com/users/Shellcat-Zero/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Shellcat-Zero/subscriptions","organizations_url":"https://api.github.com/users/Shellcat-Zero/orgs","repos_url":"https://api.github.com/users/Shellcat-Zero/repos","events_url":"https://api.github.com/users/Shellcat-Zero/events{/privacy}","received_events_url":"https://api.github.com/users/Shellcat-Zero/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-04-20T23:58:31Z","updated_at":"2015-04-21T16:22:28Z","closed_at":null,"body":"For non-LDAP users,\r\nauth requisite pam_google_authenticator.so forward_pass\r\nauth required pam_unix.so use_first_pass\r\n\r\nwill succeed.  And,\r\nauth required pam_google_authenticator.so\r\n\r\nby itself will succeed, needing only the username/authenticator-code of an LDAP user.  Then,\r\nauth required pam_unix.so\r\n\r\nby itself will succeed for LDAP users on the system, needing only their username/password.  For some reason, \"auth requisite pam_google_authenticator.so forward_pass\" does not seem to be able to recognize user passwords from LDAP users.  What should be the correct configuration for this?  The authenticating client is OpenVPN, if that matters."},"comment":{"url":"https://api.github.com/repos/google/google-authenticator/issues/comments/94859614","html_url":"https://github.com/google/google-authenticator/issues/494#issuecomment-94859614","issue_url":"https://api.github.com/repos/google/google-authenticator/issues/494","id":94859614,"user":{"login":"Shellcat-Zero","id":5893998,"avatar_url":"https://avatars.githubusercontent.com/u/5893998?v=3","gravatar_id":"","url":"https://api.github.com/users/Shellcat-Zero","html_url":"https://github.com/Shellcat-Zero","followers_url":"https://api.github.com/users/Shellcat-Zero/followers","following_url":"https://api.github.com/users/Shellcat-Zero/following{/other_user}","gists_url":"https://api.github.com/users/Shellcat-Zero/gists{/gist_id}","starred_url":"https://api.github.com/users/Shellcat-Zero/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Shellcat-Zero/subscriptions","organizations_url":"https://api.github.com/users/Shellcat-Zero/orgs","repos_url":"https://api.github.com/users/Shellcat-Zero/repos","events_url":"https://api.github.com/users/Shellcat-Zero/events{/privacy}","received_events_url":"https://api.github.com/users/Shellcat-Zero/received_events","type":"User","site_admin":false},"created_at":"2015-04-21T16:22:28Z","updated_at":"2015-04-21T16:22:28Z","body":"From syslog I get:\r\n\r\nPLUGIN_CALL: POST /usr/lib/openvpn/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1\r\nPLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib/openvpn/openvpn-plugin-auth-pam.so\r\nTLS Auth Error: Auth Username/Password verification failed for peer\r\n\r\nwhen using,\r\nauth requisite pam_google_authenticator.so forward_pass\r\nauth required pam_unix.so use_first_pass"}}