SJCaldwell
commented
7 years ago The issue here is that I don't know how to overwrite the username after a user attempts to log into ssh with it. In lines 84-97 in aad.c:
static const char *get_user_name(pam_handle_t *pamh, const Params *params){
//Obtain user's name
const char *username;
if (pam_get_user(pamh, &username, NULL) != PAM_SUCCESS ||
!username || !*username){
log_message(LOG_ERR, pamh,
"pam_get_user() failed to get a user name");
return NULL;
}
if (params -> debug){
log_message(LOG_INFO, pamh, "debug: start of azure_authenticator for %s", username);
}
return username;
}pam_get_user is being used to actually retrieve a copy of the username from pam, which has the canonical copy. I'm not sure if it's possible to edit that value, as it seems likely that for security reasons PAM devs would keep that part of memory read only.
Jnchi
Current behavior: The user must truncate their username to a length acceptable to unix (under 35 characters). The module then truncates the username in the claims token to the same length and checks they're equal.
Having a user remember to truncate their own username is obviously incredibly inconvenient. I need to determine how to truncate the username in a way that is transparent to the user.