Can PAM authenticate with Crowd
Asked by hallta:

I have a directory-based installation of Crowd which manages every component of my company, with the exception of ssh/remote login to our unix environments. It seems like an easy question, but I haven't found anyone with the answer - is there a way to have pam authenticate with crowd for remote user login.

A very similiar question (<https://answers.atlassian.com/questions/3088>), but most resources are for an LDAP install, which I don't have and don't want to install/configure.


Answers:
author: rrudnicki
body: Hi Trevor,

There isn't a native way to authenticate SSH against Crowd.

However, you can create a custom connector to do it. [In this link](https://developer.atlassian.com/display/CROWDDEV/Creating+a+Custom+Directory+Connector) you can get more details. After you create it, I believe you will also need to create a Module to Pam. [In this link](http://www.linux-pam.org/Linux-PAM-html/Linux-PAM_MWG.html) and [this](http://www.rkeene.org/projects/info/wiki/222) you can find about it.

Regards,

Renato Rudnicki

comments: author: hallta
body: That's what I thought. Thank you!


author: Caspar Krieger
body: I'm not super familiar with PAM, but you shouldn't have to create a Crowd custom directory. Crowd's REST API should be enough to let you check whether a user's username \& password are correct, if you can make your PAM module make a call to it.


author: Caspar Krieger
body: (You only need to write a custom Crowd directory if you want to change something like making users be fetched from some in-house database, etc)


author: hallta
body: Thanks, Caspar, that's a good point - I appreciate it.


author: rrudnicki
body: Another easier way to authenticate your users against crowd would be you setup a LDAP. So, you can use the LDAP connector bundled on Crowd. I know maybe you won't use a LDAP, but also you will have a lot of work writing modules (lot of works = fun :) ).Good LuckRenato RudnickiAtlassian Support


author: no_longer_in_sudoers_file
body: There is a solution: <https://bitbucket.org/atlassian/crowd_pam/wiki/Home>

Three of us (Sam Caldwell, @Brendan Shaklovitz, and Zach Boody) recently used this problem for Atlassian ShipIt 31. What we built is a working PIP package (which we need to get up to PyPI soon) that will allow users to extend PAM to authenticate against Atlassian Crowd.

Right now this only supports user/pass authentication against Crowd, but we plan on adding SSH key support and additional meta data parameters for user accounts.


author: no_longer_in_sudoers_file
body: Trevor, I asked this question once back in 2008-2009 and there was no solution. But this morning I found that Tom OConnor has done what seems a promising job of starting down that path:

<https://github.com/tomoconnor/pam_python_crowd>

I'm debating on spending a weekend or so testing this solution to see if it can be made production-ready.

comments: author: no_longer_in_sudoers_file
body: I have forked Tom O'Connor's git repo and made a couple enhancements to get this closer to production ready. There's still a bit to go, but here is my fork:<https://github.com/x684867/pam_python_crowd/blob/master/lib/security/pam_crowd.py>When I have a final solution, I'll send Tom a pull request.(Thanks, Tom for the start of a great solution)


author: hallta
body: That's fantastic, thanks for the hard work. Keep me/us posted, this work will surely come in very handy for myself and hopefully many others.


author: Brenden_Tuck
body: If you want to avoid having the python dependency, there is a new project available that does this with a native C shared object: <https://github.com/mbidewell/pam-crowd-auth>


Tags: crowd-administration