I'm trying to implement a SFTP server on Ubuntu where the users should be authenticating via an external identity provider (they provide a REST API to validate user credentials).
I've done a POC using pam_python and able to intercept the password validation logic. But now it does not allow to login if the user is not already created locally.
Failed password for invalid user john from <ip> port 63159 ssh2
I did some research and the community seem to say that user should be created locally. (06 years old ref)
I tried adding following code to create the user on the fly.
def pam_sm_authenticate(pamh, flags, argv): try: user = pamh.get_user(None) except pamh.exception as e: return e.pam_result home_dir = "/home/" + user if not os.path.exists(home_dir): os.system("useradd -m "+user+" -g sftp")
But it does not allow user to login in the same attempt and only allow if user tries to login again. Therefore, that is not user-friendly for my requirement.
sshd: Invalid user john3 from 192.168.1.1 port 64204 useradd: new user: name=john3, UID=1003, GID=1001, home=/home/john3, shell=/bin/sh, from=none sshd: Failed password for invalid user john3 from 192.168.1.1 port 64204 ssh2
Later I came across the name service switch configuration. But my requirement is to keep my external identity provider as the user list source. It is possible to achieve?