Weird Authentication Failure

[Richard Pieri]

I have a batch of Intel boxes running Scientific Linux 4.4 (a re-spin of RHELv4.4) that I am in the process of updating to SL 5.4 (a re-spin of RHELv5.4).  We have a bunch of visitor accounts (ie "vis101") that work on the 4.4 machines but not the 5.4 machines.  These accounts exist in LDAP & Kerberos, they are identical to the regular accounts used by permanent people.

Now, here's the wacky thing.  All of the LDAP and Kerberos data is correct.  If I log in as root, su to the account and kinit, the authentication works.  I can  generate tickets as that principle, do everything normally.  If I log in as myself (non-root) and su, I get an invalid password error.  I get the same error if I try to log in on console or via SSH.  I suspect something in PAM but I cannot for the life of me identify it.

Any thoughts as to where to go poking around for configuration changes or fixes?

--Rich P.