nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Can PAM authenticate with Crowd

hallta

I have a directory-based installation of Crowd which manages every component of my company, with the exception of ssh/remote login to our unix environments. It seems like an easy question, but I haven't found anyone with the answer - is there a way to have pam authenticate with crowd for remote user login.

A very similiar question (https://answers.atlassian.com/questions/3088), but most resources are for an LDAP install, which I don't have and don't want to install/configure.

Accepted answers

rrudnicki

Hi Trevor,

There isn’t a native way to authenticate SSH against Crowd.

However, you can create a custom connector to do it. In this link you can get more details. After you create it, I believe you will also need to create a Module to Pam. In this link and this you can find about it.

Regards,

Renato Rudnicki

All comments

rrudnicki

Hi Trevor,

There isn’t a native way to authenticate SSH against Crowd.

Regards,

Renato Rudnicki

hallta

That's what I thought. Thank you!

Caspar Krieger

I'm not super familiar with PAM, but you shouldn't have to create a Crowd custom directory. Crowd's REST API should be enough to let you check whether a user's username & password are correct, if you can make your PAM module make a call to it.

Caspar Krieger

(You only need to write a custom Crowd directory if you want to change something like making users be fetched from some in-house database, etc)

no_longer_in_sudoers_file

Trevor, I asked this question once back in 2008-2009 and there was no solution. But this morning I found that Tom OConnor has done what seems a promising job of starting down that path:

https://github.com/tomoconnor/pam_python_crowd

I'm debating on spending a weekend or so testing this solution to see if it can be made production-ready.

no_longer_in_sudoers_file

I have forked Tom O'Connor's git repo and made a couple enhancements to get this closer to production ready. There's still a bit to go, but here is my fork: https://github.com/x684867/pam_python_crowd/blob/master/lib/security/pam_crowd.py When I have a final solution, I'll send Tom a pull request. (Thanks, Tom for the start of a great solution)

hallta

That's fantastic, thanks for the hard work. Keep me/us posted, this work will surely come in very handy for myself and hopefully many others.

no_longer_in_sudoers_file

There is a solution: https://bitbucket.org/atlassian/crowd_pam/wiki/Home

Three of us (Sam Caldwell, @Brendan Shaklovitz, and Zach Boody) recently used this problem for Atlassian ShipIt 31. What we built is a working PIP package (which we need to get up to PyPI soon) that will allow users to extend PAM to authenticate against Atlassian Crowd.

Right now this only supports user/pass authentication against Crowd, but we plan on adding SSH key support and additional meta data parameters for user accounts.

Brenden_Tuck

If you want to avoid having the python dependency, there is a new project available that does this with a native C shared object: https://github.com/mbidewell/pam-crowd-auth

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

crowd

crowd-administration