I've setup Winbind & Kerberos on my CentOS 7 server to allow network users to login. The network users can login fine through SSH, but not through the display manager. I've experienced the same issue whether using LightDM or GDM. Local users are able to login just fine. For the network users, when they login it will accept their password but kick them back to the login screen. I have been scratching my head over this all day, tweaking pam settings to see if I can get it to work. I have also disabled SELinux and rebooted the server to rule out that possibility. Does anyone know what could be wrong here?Here are the logs for a network user login:System logs:Jul 03 16:15:01 iisfyblabetl001.incite.local lightdm[10471]: pam_unix(lightdm:auth): authentication failure; logname= uid=0 euid=0 tty=:0 ruser= rhost=  user=mmoylesJul 03 16:15:01 iisfyblabetl001.incite.local lightdm[10471]: pam_krb5[10471]: TGT verified using key for 'host/iisfyblabetl001.incite.local@INCITE.LOCAL'Jul 03 16:15:01 iisfyblabetl001.incite.local lightdm[10471]: pam_krb5[10471]: authentication succeeds for 'mmoyles' (mmoyles@INCITE.LOCAL)Jul 03 16:15:01 iisfyblabetl001.incite.local lightdm[10471]: pam_winbind(lightdm:account): user 'mmoyles' granted accessJul 03 16:15:01 iisfyblabetl001.incite.local lightdm[9639]: pam_unix(lightdm-greeter:session): session closed for user lightdmJul 03 16:15:01 iisfyblabetl001.incite.local systemd-logind[679]: New session 29 of user mmoyles.-- Subject: A new session 29 has been created for user mmoyles-- Defined-By: systemd-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel-- Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat---- A new session with the ID 29 has been created for the user mmoyles.---- The leading process of the session is 10471.Jul 03 16:15:01 iisfyblabetl001.incite.local systemd[1]: Started Session 29 of user mmoyles.-- Subject: Unit session-29.scope has finished start-up-- Defined-By: systemd-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel---- Unit session-29.scope has finished starting up.---- The start-up result is done.Jul 03 16:15:01 iisfyblabetl001.incite.local systemd[1]: Starting Session 29 of user mmoyles.-- Subject: Unit session-29.scope has begun start-up-- Defined-By: systemd-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel---- Unit session-29.scope has begun starting up.Jul 03 16:15:01 iisfyblabetl001.incite.local lightdm[10471]: pam_unix(lightdm:session): session opened for user mmoyles by (uid=0)Jul 03 16:15:01 iisfyblabetl001.incite.local lightdm[10471]: pam_unix(lightdm:session): session closed for user mmoylesJul 03 16:15:01 iisfyblabetl001.incite.local systemd-logind[679]: Removed session 29.-- Subject: Session 29 has been terminated-- Defined-By: systemd-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel-- Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat---- A session with the ID 29 has been terminated.Jul 03 16:15:01 iisfyblabetl001.incite.local lightdm[10517]: pam_unix(lightdm-greeter:session): session opened for user lightdm by (uid=0)Jul 03 16:15:01 iisfyblabetl001.incite.local systemd-logind[679]: New session c19 of user lightdm.-- Subject: A new session c19 has been created for user lightdm-- Defined-By: systemd-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel-- Documentation: http://www.freedesktop.org/wiki/Software/systemd/multiseat---- A new session with the ID c19 has been created for the user lightdm.lightdm.log:+1215.10s] DEBUG: Seat: Greeter stopped, running session[+1215.10s] DEBUG: Registering session with bus path /org/freedesktop/DisplayManager/Session6[+1215.10s] DEBUG: Session pid=10471: Running command /etc/X11/xinit/Xsession mate-session[+1215.10s] DEBUG: Creating shared data directory /var/lib/lightdm-data/mmoyles[+1215.10s] DEBUG: Session pid=10471: Logging to .xsession-errors[+1215.14s] DEBUG: Activating VT 1[+1215.14s] DEBUG: Activating login1 session 29[+1215.17s] DEBUG: Session pid=10471: Exited with return value 0[+1215.17s] DEBUG: Seat: Session stopped[+1215.17s] DEBUG: Seat: Stopping display server, no sessions require it[+1215.17s] DEBUG: Sending signal 15 to process 9627[+1215.24s] DEBUG: Process 9627 exited with return value 0[+1215.24s] DEBUG: DisplayServer x-0: X server stopped[+1215.24s] DEBUG: Releasing VT 1[+1215.24s] DEBUG: DisplayServer x-0: Removing X server authority /var/run/lightdm/root/:0[+1215.24s] DEBUG: Seat: Display server stopped[+1215.24s] DEBUG: Seat: Active display server stopped, starting greeter[+1215.24s] DEBUG: Seat: Creating greeter session[+1215.24s] DEBUG: Seat: Creating display server of type x[+1215.24s] DEBUG: Using VT 1[+1215.24s] DEBUG: Seat: Starting local X display on VT 1[+1215.24s] DEBUG: DisplayServer x-0: Logging to /var/log/lightdm/x-0.log[+1215.24s] DEBUG: DisplayServer x-0: Writing X server authority to /var/run/lightdm/root/:0[+1215.24s] DEBUG: DisplayServer x-0: Launching X Server[+1215.24s] DEBUG: Launching process 10509: /usr/bin/X -background none :0 -seat seat0 -auth /var/run/lightdm/root/:0 -nolisten tcp vt1 -novtswitch[+1215.24s] DEBUG: DisplayServer x-0: Waiting for ready signal from X server :0[+1215.42s] DEBUG: Got signal 10 from process 10509[+1215.43s] DEBUG: DisplayServer x-0: Got signal from X server :0[+1215.43s] DEBUG: DisplayServer x-0: Connecting to XServer :0[+1215.43s] DEBUG: Seat: Display server ready, starting session authentication[+1215.43s] DEBUG: Session pid=10517: Started with service 'lightdm-greeter', username 'lightdm'[+1215.44s] DEBUG: Session pid=10517: Authentication complete with return value 0: Success[+1215.44s] DEBUG: Seat: Session authenticated, running command[+1215.44s] DEBUG: Session pid=10517: Running command /usr/sbin/lightdm-gtk-greeter[+1215.44s] DEBUG: Creating shared data directory /var/lib/lightdm-data/lightdm[+1215.44s] DEBUG: Session pid=10517: Logging to /var/log/lightdm/x-0-greeter.log[+1215.44s] DEBUG: Activating VT 1[+1215.44s] DEBUG: Activating login1 session c19[+1215.46s] DEBUG: Session pid=10517: Greeter connected version=1.10.6[+1215.69s] DEBUG: Session pid=10517: Greeter start authentication[+1215.69s] DEBUG: Session pid=10535: Started with service 'lightdm', username '(null)'[+1215.70s] DEBUG: Session pid=10535: Got 1 message(s) from PAM[+1215.70s] DEBUG: Session pid=10517: Prompt greeter with 1 message(s)[+1215.73s] DEBUG: User /org/freedesktop/Accounts/User1000 changed[+1215.74s] DEBUG: User /org/freedesktop/Accounts/User11092 changed[+1215.74s] DEBUG: User /org/freedesktop/Accounts/User1001 changedpam.d/system-auth#%PAM-1.0# This file is auto-generated.# User changes will be destroyed the next time authconfig is run.auth        required      pam_env.soauth        sufficient    pam_unix.so nullok try_first_pass#auth        requisite     pam_succeed_if.so uid >= 1000 quiet_successauth        sufficient    pam_krb5.so use_first_passauth        sufficient    pam_winbind.so krb5_auth krb5_ccache_type=KEYRING use_first_passauth        required      pam_deny.soaccount     required      pam_unix.so broken_shadowaccount     sufficient    pam_localuser.so#account     sufficient    pam_succeed_if.so uid < 1000 quietaccount     [default=bad success=ok user_unknown=ignore] pam_krb5.soaccount     [default=bad success=ok user_unknown=ignore] pam_winbind.so krb5_auth krb5_ccache_type=KEYRINGaccount     required      pam_permit.sopassword    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtokpassword    sufficient    pam_krb5.so use_authtokpassword    sufficient    pam_winbind.so krb5_auth krb5_ccache_type=KEYRING use_authtokpassword    required      pam_deny.sosession     optional      pam_keyinit.so revokesession     required      pam_limits.so-session     optional      pam_systemd.sosession     optional      pam_oddjob_mkhomedir.so umask=0077session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uidsession     required      pam_unix.sosession     optional      pam_krb5.sosession     optional      pam_winbind.so krb5_auth krb5_ccache_type=KEYRINGpam.d/lightdm#%PAM-1.0auth     [success=done ignore=ignore default=bad] pam_selinux_permit.soauth       required    pam_env.soauth       substack    system-auth-auth       optional    pam_gnome_keyring.so-auth       optional    pam_kwallet5.so-auth       optional    pam_kwallet.soauth       include     postloginaccount    required    pam_nologin.soaccount    include     system-authpassword   include     system-authsession    optional    pam_selinux.so closesession    optional    pam_loginuid.sosession    optional    pam_console.so-session    optional    pam_ck_connector.sosession    optional    pam_selinux.so opensession    optional    pam_keyinit.so force revokesession    optional    pam_namespace.so-session    optional    pam_gnome_keyring.so auto_start-session    optional    pam_kwallet5.so-session    optional    pam_kwallet.sosession    include     system-authsession    optional    pam_lastlog.so silentsession    include     postloginThe .xsession-errors file in the network user's home directory is empty, and it does appear to create an .Xauthority file in the home directory.
AD Users Cannot Login Through GDM/LightDM
active directory;kerberos;lightdm;winbind
Well I feel dumb... After battling with this problem for 3 days, The reason was that I had a .profile in /etc/skel that was setting SHELL=/bin/bash so pam_mkhomedir was adding this file for new domain users but it wasn't on my local account.