CODEWITHSUNDEEP
rundeckpam
s0p4L1n3
s0p4L1n3

Reputation: 1

Authenticate Active Directory users with PAM module and sshd service

I've just installed a fresh Rundeck server:

It is running behind NGINX with TLS Certificate. No issue on this.

I'm trying to setup external authentication not with the LDAP module but with the PAM module that comes with Rundeck. The server is already joined to our Active Directory domain with Winbind and Samba.

When I am trying to log with my domain user on the web UI, the Web UI display "Wrong username or password" while the logs tells the opposite.

I have edited the jaas conf file and added the Pam method

org.rundeck.jaas.jettyPamLoginModule requisite
      debug="true"
      service="sshd"
      supplementalRoles="readonly"
      storePass="true"

org.eclipse.jetty.jaas.spi.PropertyFileLoginModule required
      debug="true"
      file="/etc/rundeck/realm.properties";

When I try to log with AD user, the rundeck service log display that it succeeded:

[2023-03-08T13:35:12,068] DEBUG pam.AbstractPamLoginModule - PAM authentication trying (sshd) for: jsmith
[2023-03-08T13:35:12,416] DEBUG pam.AbstractPamLoginModule - PAM authentication succeeded for: jsmith

But the access logs shows the opposite:

[2023-03-08T13:35:12,068] INFO web.requests "GET /user/error" [0:0:0:0:0:0:0:1] http form 303 ? [] (Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36)

Does it success but can not login because the AD user does not exists in the Rundeck database ?

Thank you for you help

Upvotes: 0

Views: 251

Answers (1)

MegaDrive68k
MegaDrive68k

Reputation: 4325

Off the record answer:

It works with the followin config:

RDpropertyfilelogin { 
  org.rundeck.jaas.jetty.JettyPamLoginModule requisite 
    debug="true" 
    service="sshd" 
    supplementalRoles="readonly" 
    storePass="true"; 

  org.rundeck.jaas.jetty.JettyRolePropertyFileLoginModule required        
    debug="true" 
    useFirstPass="true" 
    file="/etc/rundeck/realm.properties"; 

  org.ecliplse.jetty.jaas.spi.PropertyFileLoginModule required 
    debug="true" file="/etc/rundeck/realm.properties"; 
};

Upvotes: 0

Related Questions