So, I have this 3rd party application that uses usernames in the format user@domain.
More precisely, it uses the UPN from ActiveDirectory, e.g. john.doe@company.local.
That’s fine in this application. However, the application implements an AD-Bridge sort of thing where it temporarily creates user accounts in Linux and in a later step logs on using this user.
And that’s where the problems start: the application tried adding a Linux user with a UPN-style user name.
This failed because @ is not allowed as a user name. Fortunately the 3rd party product had scripts that controlled how to create the user. So we changed those to strip the @company.local part using sed ‘s/@company.local//g’ which worked fine in creating the user.
Unfortunately the login after user creation still uses the UPN-style username and is not configurable in the product.
Searching Google for possible solutions, I got the impression, that PAM may be able to alter the user name during logon via SSH.
What I’m looking for is a way to instruct PAM to strip @company.local from a given username (e.g. john.doe@company.local) and continue the authentication request with just the part before the @ sign (john.doe in this case).
Is this even possible with PAM? How?
All users are local Linux users in /etc/passwd, no LDAP being used nor available.
