[feature]: pam_radius_auth supporting realms

[jhaar]

What type of defect/bug is this?

Unexpected behaviour (obvious or verified by project member)

How can the issue be reproduced?

I was trying to use pam_radius_auth to protect sudo with MFA - where MFA was provided by our enterprise Okta RADIUS server. However that uses "[email protected]" - whereas our Unix systems use "username". So pam_radius_auth was creating RADIUS authentication requests with "username/password" instead of "[email protected]/password" and didn't work. If I made an Unix account named "[email protected]" then pam_radius_auth worked just fine.

I think adding a new option of "[email protected]" which would append itself to the username would help a lot. A lot of enterprises are doing SSO these days so this would enable stronger authentication options to be added to Unix accounts

Log output from the FreeRADIUS daemon

not a bug

Relevant log output from client utilities

No response

Backtrace from LLDB or GDB

No response

[alandekok]

The pam_radius_auth module sends the name / password as entered by the user. Any functional RADIUS server can add / delete / change realms when it receives the Access-Request.

It's not clear to me why this configuration would be required on the local machine. It's much better to centralize this on the RADIUS server.

[jhaar]

Enterprises tend to have many realms. So having the "client" tell the RADUIS server the fully qualified username makes more sense (as the admin of that system knows what their user audience is) rather than relying on (typically) CorpIS to micro-manage per-host mappings

[alandekok]

You're free to send a patch which implements this feature.

Or, if it's needed for an enterprise, perhaps they have budget to help sponsor this.

Until then, if no one is willing to work for free, then no progress will be made.

[mcnewton]

This is not something we are likely to look at without sponsorship, and the issue isn't related to the FreeRADIUS server anyway.

[jpereira]

Hi @jhaar

please, suggest your company contact [email protected] requesting a quote about that feature.