So, I have this 3rd party application that uses usernames in the format
More precisely, it uses the UPN from ActiveDirectory, e.g.
That’s fine in this application. However, the application implements an AD-Bridge sort of thing where it temporarily creates user accounts in Linux and in a later step logs on using this user.
And that’s where the problems start: the application tried adding a Linux user with a UPN-style user name.
This failed because
@ is not allowed as a user name. Fortunately the 3rd party product had scripts that controlled how to create the user. So we changed those to strip the
@company.local part using
sed ‘firstname.lastname@example.org//g’ which worked fine in creating the user.
Unfortunately the login after user creation still uses the UPN-style username and is not configurable in the product.
Searching Google for possible solutions, I got the impression, that PAM may be able to alter the user name during logon via SSH.
What I’m looking for is a way to instruct PAM to strip
@company.local from a given username (e.g.
email@example.com) and continue the authentication request with just the part before the
@ sign (
john.doe in this case).
Is this even possible with PAM? How?
All users are local Linux users in
/etc/passwd, no LDAP being used nor available.