How to allow Linux PAM Authentication for non-Local users

Question

I'm trying to implement a SFTP server on Ubuntu where the users should be authenticating via an external identity provider (they provide a REST API to validate user credentials).

I've done a POC using pam_python and able to intercept the password validation logic. But now it does not allow to login if the user is not already created locally.

Failed password for invalid user john from <ip> port 63159 ssh2

I did some research and the community seem to say that user should be created locally. (06 years old ref)

I tried adding following code to create the user on the fly.

def pam_sm_authenticate(pamh, flags, argv):
  try:
    user = pamh.get_user(None)
  except pamh.exception as e:
    return e.pam_result
  
  home_dir = "/home/" + user
  if not os.path.exists(home_dir):
    os.system("useradd -m "+user+" -g sftp")

But it does not allow user to login in the same attempt and only allow if user tries to login again. Therefore, that is not user-friendly for my requirement.

sshd[8296]: Invalid user john3 from 192.168.1.1 port 64204

useradd[8299]: new user: name=john3, UID=1003, GID=1001, home=/home/john3, shell=/bin/sh, from=none
sshd[8296]: Failed password for invalid user john3 from 192.168.1.1 port 64204 ssh2

Later I came across the name service switch configuration. But my requirement is to keep my external identity provider as the user list source. It is possible to achieve?

Answer 1

If the external identity provider uses OpenID, then my best bet would be to use FreeIPA and SSSD. However, this might be difficult to integrate. The following link details the design of the solution and may be of help to you: https://freeipa.readthedocs.io/en/latest/designs/external-idp/external-idp.html