I'm trying to implement a SFTP server on Ubuntu where the users should be authenticating via an external identity provider (they provide a REST API to validate user credentials).

I've done a POC using pam_python and able to intercept the password validation logic. But now it does not allow to login if the user is not already created locally.

Failed password for invalid user john from <ip> port 63159 ssh2

I did some research and the community seem to say that user should be created locally. (06 years old ref)

I tried adding following code to create the user on the fly.

def pam_sm_authenticate(pamh, flags, argv):
    user = pamh.get_user(None)
  except pamh.exception as e:
    return e.pam_result
  home_dir = "/home/" + user
  if not os.path.exists(home_dir):
    os.system("useradd -m "+user+" -g sftp")

But it does not allow user to login in the same attempt and only allow if user tries to login again. Therefore, that is not user-friendly for my requirement.

sshd[8296]: Invalid user john3 from port 64204

useradd[8299]: new user: name=john3, UID=1003, GID=1001, home=/home/john3, shell=/bin/sh, from=none
sshd[8296]: Failed password for invalid user john3 from port 64204 ssh2

Later I came across the name service switch configuration. But my requirement is to keep my external identity provider as the user list source. It is possible to achieve?

1 Answer 1


If the external identity provider uses OpenID, then my best bet would be to use FreeIPA and SSSD. However, this might be difficult to integrate. The following link details the design of the solution and may be of help to you: https://freeipa.readthedocs.io/en/latest/designs/external-idp/external-idp.html

  • 1
    As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center.
    – Community Bot
    Aug 29 at 17:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .