Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Implement username extraction mechanism using regular expressions #42

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Implement username extraction mechanism using regular expressions #42

wants to merge 1 commit into from

Commits on Jan 7, 2021

  1. Implement username extraction mechanism using regular expressions 

    The implemented functionality allows extracting LDAP usernames from usernames supplied to PAM. The regular expression-based mechanism provides a simple but efficient technique to use prefixes and/or suffixes to distinguish local and LDAP users preventing username clashes.

For example, there is a local UNIX user account johndoe. The same user has a corporate LDAP account uid=johndoe,cn=users,dc=domain,dc=net.

The following configuration allows this user to log in with a local account johndoe - in this case, pam_unix handles the authentication and pam_ldap is skipped on success. At the same time, [email protected] won't be authenticated by pam_unix, so that pam_ldap will extract the username using the regular expression ^(.*)@domain.net$ and try to authenticate johndoe against the LDAP server. Also, in this example, we use Google Authenticator based 2fa authentication for both local and LDAP users.

auth    [success=1 default=ignore]  pam_unix.so
auth    requisite                   pam_ldap.so use_first_pass [extract_username=/^(.*)@domain.net$/]
auth    required                    pam_google_authenticator.so [authtok_prompt=Enter an authenticator app code.]

Configuration options:
extract_username=[0..9]/regex_pattern/[i]
The first number specifies the regex capturing group to be used for username extraction. In some complex regex expressions with multiple groups, this allows to explicitly specify the group number needed. E.g. 2/^(EXT|EXTERNAL)\\(.*)$/
The number could be omitted, the default value is 1.
The optional trailing flag 'i' indicates that the regex match will be case-insensitive.

extract_username_required
This flag indicates that successful extraction is mandatory to authenticate the user. Otherwise, if extraction fails, pam_ldap will try to authenticate the user with the originally provided username.

Signed-off-by: Andriy Sharandakov <[email protected]>
    @ashway83
    ashway83 committed Jan 7, 2021
    Configuration menu
    Copy the full SHA
    bf10958 View commit details
    Browse the repository at this point in the history