Story #15348

[pam] PAM module in Go

Added by Tom Clegg 4 months ago. Updated 4 months ago.

Status:
New
Priority:
Normal
Assigned To:
-
Category:
-
Target version:
Start date:
Due date:
% Done:

0%

Estimated time:
Story points:
3.0

Description

Functionally equivalent to source:sdk/pam but reliable, and packaged as a binary (no dependency on python-pam, python, etc).

The glue for interfacing with PAM, building a shared library, etc. can be taken from MIT-licensed https://github.com/uber/pam-ussh

Authentication:
  • Get desired username from PAM
  • Call PAM to prompt for token (in python this was token = pamh.conversation(pamh.Message(pamh.PAM_PROMPT_ECHO_OFF, prompt)).resp)
  • Use given token to look up current user
  • Use given token to look up virtual_machine matching configured hostname
  • Use given token to look up permission link with matching VM uuid, user uuid, can_login, and properties[username]
  • Log request & outcome
  • Return true/false

Related issues

Related to Arvados - Story #14964: Port arvados-pam to Python 3New

History

#1 Updated by Tom Clegg 4 months ago

  • Related to Story #14964: Port arvados-pam to Python 3 added

#2 Updated by Tom Morris 4 months ago

  • Story points set to 3.0
  • Target version set to Arvados Future Sprints

Also available in: Atom PDF