shimt/pam-exec-oauth2

Allows Linux user authentication to OAuth2 via pam_exec

pam-exec-oauth2

This repository is no longer maintained.

Install

go get github.com/shimt/pam-exec-oauth2

PREFIX=/opt/pam-exec-oauth2

sudo mkdir $PREFIX
sudo cp go/bin/pam-exec-oauth2 $PREFIX/pam-exec-oauth2
sudo touch $PREFIX/pam-exec-oauth2.yaml
sudo chmod 755 $PREFIX/pam-exec-oauth2
sudo chmod 600 $PREFIX/pam-exec-oauth2.yaml

Configuration

PAM

add the following lines to /etc/pam.d/common-auth.

auth sufficient pam_exec.so expose_authtok /opt/pam-exec-oauth2/pam-exec-oauth2

pam-exec-oauth2.yaml

edit /opt/pam-exec-oauth2/pam-exec-oauth2.yaml

Azure AD

{
    client-id: "xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    client-secret: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    redirect-url: "urn:ietf:wg:oauth:2.0:oob",
    scopes: ["email"],
    endpoint-auth-url: "https://login.windows.net/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/oauth2/authorize",
    endpoint-token-url: "https://login.windows.net/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/oauth2/token",
    extra-parameters: {
        resource: "https://graph.windows.net/"
    },
    username-format: "%[email protected]",
}

pam-exec-oauth2's Issues

Can't use with Google oAuth

Hi,

Thanks for the project!
I have manage to make it work with few oAuth provider, but I can't make it work with google.

See here: https://developers.google.com/identity/protocols/oauth2/native-app#uwp

Seems like the token can't be created.
When doing it manually like in here
https://gist.github.com/LindaLawton/cff75182aac5fa42930a09f58b63a309

I manage to get a token, but from the module never.
I have try to play with the extra parameters:
extra-parameters: {
code: "4/zQGHtWcSaV_C53wrHLv85xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
grant_type: "authorization_code",

Nothing seems to be working :-(

Can you please help?

},

KeyCloak + OTP

Is there a way to make this work if the keycloak user has otp enabled ? ( keeping otp enabled )

unable to build

When building pam-exec-oauth2 this error appears:
./main.go:110: oauth2Config.PasswordCredentialsTokenEx undefined (type oauth2.Config has no field or method PasswordCredentialsTokenEx)

Please tag a version

Clearly this is being used in production, but I'm trying to make distro packages for it and it's very hard to do right without a version number. Please tag a release, even if it's v0.0.1-alpha1 or whatever.

Error in installer

Good evening,
I will appreciate any help! I am completely new to Go apps, i tried but I couldnt pass first line!

Just in case: Im using Ubuntu 20.04 and go version go1.13.8 linux/amd64

$ go get github.com/shimt/pam-exec-oauth2
package github.com/hashicorp/hcl/hcl/printer: cannot find package "github.com/hashicorp/hcl/hcl/printer" in any of:
/usr/lib/go-1.13/src/github.com/hashicorp/hcl/hcl/printer (from $GOROOT)
/home/user/go/src/github.com/hashicorp/hcl/hcl/printer (from $GOPATH)

I tried an workaround from https://github.com/spf13/viper/blob/master/TROUBLESHOOTING.md#cannot-find-package

but no luck:

$ export GO111MODULE=on
$ go get github.com/shimt/pam-exec-oauth2
go: finding github.com/shimt/pam-exec-oauth2 latest
go: downloading github.com/shimt/pam-exec-oauth2 v0.0.0-20200309114006-023ac35ab559
go: extracting github.com/shimt/pam-exec-oauth2 v0.0.0-20200309114006-023ac35ab559
go: downloading github.com/shimt/go-simplecli v0.0.4
go: downloading golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d
go: extracting github.com/shimt/go-simplecli v0.0.4
go: downloading github.com/spf13/viper v1.6.2
go: downloading github.com/shimt/go-logif v0.0.4
go: downloading github.com/pkg/errors v0.9.1
go: downloading github.com/spf13/pflag v1.0.5
go: downloading github.com/pkg/profile v1.4.0
go: extracting golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d
go: downloading golang.org/x/net v0.0.0-20200301022130-244492dfa37a
go: downloading google.golang.org/appengine v1.6.5
go: extracting github.com/pkg/errors v0.9.1
go: extracting github.com/spf13/viper v1.6.2
go: downloading github.com/hashicorp/hcl v1.0.0
go: downloading github.com/pelletier/go-toml v1.6.0
go: extracting github.com/shimt/go-logif v0.0.4
go: downloading github.com/spf13/cast v1.3.1
go: downloading github.com/magiconair/properties v1.8.1
go: extracting github.com/pkg/profile v1.4.0
go: downloading gopkg.in/ini.v1 v1.54.0
go: downloading github.com/fsnotify/fsnotify v1.4.7
go: downloading github.com/spf13/jwalterweatherman v1.1.0
go: extracting github.com/spf13/pflag v1.0.5
go: downloading github.com/subosito/gotenv v1.2.0
go: extracting github.com/subosito/gotenv v1.2.0
go: extracting google.golang.org/appengine v1.6.5
go: extracting github.com/hashicorp/hcl v1.0.0
go: downloading gopkg.in/yaml.v2 v2.2.8
go: extracting github.com/pelletier/go-toml v1.6.0
go: extracting github.com/spf13/jwalterweatherman v1.1.0
go: extracting github.com/magiconair/properties v1.8.1
go: extracting github.com/fsnotify/fsnotify v1.4.7
go: downloading github.com/spf13/afero v1.2.2
go: extracting github.com/spf13/cast v1.3.1
go: extracting gopkg.in/yaml.v2 v2.2.8
go: downloading github.com/golang/protobuf v1.3.4
go: extracting golang.org/x/net v0.0.0-20200301022130-244492dfa37a
go: extracting gopkg.in/ini.v1 v1.54.0
go: downloading github.com/mitchellh/mapstructure v1.1.2
go: downloading golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527
go: extracting github.com/mitchellh/mapstructure v1.1.2
go: extracting github.com/spf13/afero v1.2.2
go: downloading golang.org/x/text v0.3.2
go: extracting github.com/golang/protobuf v1.3.4
go: extracting golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527
go: extracting golang.org/x/text v0.3.2
go: finding github.com/shimt/go-simplecli v0.0.4
go: finding golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d
go: finding github.com/pkg/errors v0.9.1
go: finding github.com/pkg/profile v1.4.0
go: finding github.com/shimt/go-logif v0.0.4
go: finding github.com/spf13/pflag v1.0.5
go: finding github.com/spf13/viper v1.6.2
go: finding github.com/fsnotify/fsnotify v1.4.7
go: finding golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527
go: finding golang.org/x/net v0.0.0-20200301022130-244492dfa37a
go: finding github.com/hashicorp/hcl v1.0.0
go: finding github.com/magiconair/properties v1.8.1
go: finding github.com/mitchellh/mapstructure v1.1.2
go: finding github.com/pelletier/go-toml v1.6.0
go: finding github.com/spf13/afero v1.2.2
go: finding github.com/spf13/cast v1.3.1
go: finding golang.org/x/text v0.3.2
go: finding github.com/spf13/jwalterweatherman v1.1.0
go: finding github.com/subosito/gotenv v1.2.0
go: finding gopkg.in/ini.v1 v1.54.0
go: finding gopkg.in/yaml.v2 v2.2.8
# github.com/shimt/pam-exec-oauth2
go/pkg/mod/github.com/shimt/[email protected]/main.go:110:34: oauth2Config.PasswordCredentialsTokenEx undefined (type oauth2.Config has no field or method PasswordCredentialsTokenEx)

Documentation

Hey! This looks really cool :)

Do you have any documentation on using this with a generic OAuth2 provider not just Azure AD? What type of authentication flow is this using, and what scopes do I need to give this client etc? please?

Thanks!

SSH using this pam module

Hi,

can i use user and password for SSH login using this PAM module.
or this pam module works only with user name and access token?

Thanks and regards,
Adishesh

Oauth1.0a compatibility

Hello, does it work with Oauth1.0a? Thank you

Installation instruction

We're trying to use this module. But install steps not clear for me...
sudo cp go/bin/pam-exec-oauth2 $PREFIX/pam-exec-oauth2 --- gitrepo doesn't have pam-exec-oauth2.
And if I run build script, I got the following:
root@vagrant:/root/pam-exec-oauth2# ./build-linux-amd64.bat
main.go:31:2: cannot find package "github.com/shimt/go-simplecli" in any of:
/usr/lib/go-1.10/src/github.com/shimt/go-simplecli (from $GOROOT)
/home/vagrant/go/src/github.com/shimt/go-simplecli (from $GOPATH)
main.go:32:2: cannot find package "golang.org/x/oauth2" in any of:
/usr/lib/go-1.10/src/golang.org/x/oauth2 (from $GOROOT)
/home/vagrant/go/src/golang.org/x/oauth2 (from $GOPATH)

How this module should be installed? Please, help.