Since you are using Solaris, and the problem is with old users, added with
the PADL MigrationTools, vs new users, this might be a userPassword
attribute issue in LDAP.

The PADL will add the old password to LDAP using the string: {crypt}crypted-password
where crypted-password was copied from /etc/shadow or NIS.

If you used some other tool to add new users to ldap with a userPassword
(or no userPasswrod) it might be adding a value which the Solaris pam
considers to be a locked account. So look at how you added the
new users to ldap.

Test as *root* with:

ldaplist -l username

It should have a line with
userPassword: {crypt}crypted-password

If its not{crypt}something
then try changing it to use {crypt}

the getpw.c program I sent yesterday should return (assuming the username
is not also in the local /etc/passwd file):


Douglas E. Engert
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
openssh-unix-dev mailing list