So, I have this 3rd party application that uses usernames in the format user@domain.

More precisely, it uses the UPN from ActiveDirectory, e.g. john.doe@company.local.

That’s fine in this application. However, the application implements an AD-Bridge sort of thing where it temporarily creates user accounts in Linux and in a later step logs on using this user.

And that’s where the problems start: the application tried adding a Linux user with a UPN-style user name.

This failed because @ is not allowed as a user name. Fortunately the 3rd party product had scripts that controlled how to create the user. So we changed those to strip the @company.local part using sed ‘s/@company.local//g’ which worked fine in creating the user. Unfortunately the login after user creation still uses the UPN-style username and is not configurable in the product.

Searching Google for possible solutions, I got the impression, that PAM may be able to alter the user name during logon via SSH. What I’m looking for is a way to instruct PAM to strip @company.local from a given username (e.g. john.doe@company.local) and continue the authentication request with just the part before the @ sign (john.doe in this case).

Is this even possible with PAM? How?

All users are local Linux users in /etc/passwd, no LDAP being used nor available.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy