# Mod\_authnz\_external and pam authentication

**URL:** <https://discourse.openondemand.org/t/mod-authnz-external-and-pam-authentication/3467>\
**Category:** Get Help\
**Tags:** question\
**Created:** [May 4, 2024, 1:51am UTC](https://discourse.openondemand.org/t/mod-authnz-external-and-pam-authentication/3467 "2024-05-04T01:51:43Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![KMFernsler](https://avatars.discourse-cdn.com/v4/letter/k/258eb7/32.png) [@KMFernsler](https://discourse.openondemand.org/u/KMFernsler)\
**Post date:** [May 4, 2024, 1:51am UTC](https://discourse.openondemand.org/t/mod-authnz-external-and-pam-authentication/3467/1 "2024-05-04T01:51:43Z")

</div>

Hi,

We’re trying to use radius/pam for our authentication to Open Ondemand.

Both mod\_authnz\_external and mod\_autnz\_pam modules are loaded.

The pwauth command with the pam module works to authentifcate users correctly.

What exactly should the authnz\_external.conf and authnz\_pam.conf look like?  
What exactly should the auth: config in ood-portal.yml look like?

It seems like it might work for the first location, but then it appears to re-ask for the credentials for for every page element without passing the credentials on.

Does Open Ondemand even support this type of authentication?

thanks,  
-k

---

<div class="post-metadata">

**Author:** ![KMFernsler](https://avatars.discourse-cdn.com/v4/letter/k/258eb7/32.png) [@KMFernsler](https://discourse.openondemand.org/u/KMFernsler)\
**Post date:** [May 6, 2024, 5:45pm UTC](https://discourse.openondemand.org/t/mod-authnz-external-and-pam-authentication/3467/2 "2024-05-06T17:45:03Z")

</div>

We’re running Rocky8 and OOD 3.1 for more info.

thanks!

---

<div class="post-metadata">

**Author:** ![KMFernsler](https://avatars.discourse-cdn.com/v4/letter/k/258eb7/32.png) [@KMFernsler](https://discourse.openondemand.org/u/KMFernsler)\
**Post date:** [May 6, 2024, 6:54pm UTC](https://discourse.openondemand.org/t/mod-authnz-external-and-pam-authentication/3467/3 "2024-05-06T18:54:26Z")

</div>

Additional info:

Following Randall White’s example in 3.1 we’re seeing that ood will start ngnix processes as the user:  
fernsler 3597 0.0 0.0 366808 13228 ? Ssl 11:41 0:00 Passenger watchdog  
fernsler 3600 0.0 0.0 1418368 15196 ? Sl 11:41 0:00 Passenger core  
root 3616 0.0 0.0 91792 2564 ? Ss 11:41 0:00 nginx: master process (fernsler) -c /var/lib/ondemand-nginx/config/puns/fernsler.conf  
fernsler 3620 0.0 0.0 105928 7332 ? S 11:41 0:00 nginx: worker process  
fernsler 4121 2.6 0.2 361992 91560 ? Sl 11:49 0:01 Passenger RubyApp: /var/www/ood/apps/sys/dashboard (production)  
root 4209 0.0 0.0 221948 1208 pts/0 S+ 11:50 0:00 grep --color=auto fernsler

But seems to want to re-authenticate on every subsequent page element:

relevant log excerpt:  
[Mon May 06 11:49:29.311342 2024] [lua:info] [pid 3835:tid 140102021490432] [client 131.243.153.150:51411] log\_time=“2024-05-06T18:49:29.311265.0Z” res\_content\_encoding=“” req\_accept\_language=“en-us,en;q=0.5” req\_user\_agent=“Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:125.0) Gecko/20100101 Firefox/125.0” req\_status=“304” req\_origin=“” local\_user=“fernsler” req\_server\_name=“[hpcs-oodev8.lbl.gov](http://hpcs-oodev8.lbl.gov)” req\_cache\_control=“” req\_port=“443” res\_content\_location=“” res\_content\_type=“” res\_location=“” req\_handler=“proxy-server” req\_accept\_charset=“” log\_hook=“ood” req\_is\_https=“true” req\_user\_ip=“131.243.153.150” remote\_user=“fernsler” allowed\_hosts=“10.0.2.4,128.3.7.247,[hpcs-oodev8.lbl.gov](http://hpcs-oodev8.lbl.gov)” req\_content\_type=“” req\_uri=“/pun/sys/dashboard/assets/pinned\_apps-95c603b0cc05dad1a3e420b7ced9d8e2a926cd68ea8c86eb31bbb3d1b685ada1.js” req\_referer=“[https://hpcs-oodev8.lbl.gov/pun/sys/dashboard](https://hpcs-oodev8.lbl.gov/pun/sys/dashboard)” req\_accept\_encoding=“gzip, deflate, br” req\_method=“GET” res\_content\_disp=“” req\_filename=“proxy:[http://localhost/pun/sys/dashboard/assets/pinned\_apps-95c603b0cc05dad1a3e420b7ced9d8e2a926cd68ea8c86eb31bbb3d1b685ada1.js](http://localhost/pun/sys/dashboard/assets/pinned_apps-95c603b0cc05dad1a3e420b7ced9d8e2a926cd68ea8c86eb31bbb3d1b685ada1.js)” req\_is\_websocket=“false” res\_content\_language=“” time\_proxy=“0.599” time\_user\_map=“0.002” req\_hostname=“[hpcs-oodev8.lbl.gov](http://hpcs-oodev8.lbl.gov)” res\_content\_length=“” req\_protocol=“HTTP/1.1” req\_accept=“_/_”, referer: [https://hpcs-oodev8.lbl.gov/pun/sys/dashboard](https://hpcs-oodev8.lbl.gov/pun/sys/dashboard)  
[Mon May 06 11:49:29.979320 2024] [authnz\_pam:warn] [pid 3836:tid 140101749298944] [client 131.243.153.150:51409] PAM authentication failed for user fernsler: Authentication failure, referer: [https://hpcs-oodev8.lbl.gov/pun/sys/dashboard](https://hpcs-oodev8.lbl.gov/pun/sys/dashboard)  
[Mon May 06 11:49:29.979847 2024] [auth\_basic:error] [pid 3836:tid 140101749298944] [client 131.243.153.150:51409] AH01617: user fernsler: authentication failure for “/pun/sys/dashboard/assets/dashboard-42b56f7f42474effe1e8f2d4fa0300bf463bed5d4eec7db1c70badde9070c077.js”: Password Mismatch, referer: [https://hpcs-oodev8.lbl.gov/pun/sys/dashboard](https://hpcs-oodev8.lbl.gov/pun/sys/dashboard)  
[Mon May 06 11:49:30.631362 2024] [authnz\_pam:warn] [pid 3835:tid 140102013097728] [client 131.243.153.150:51410] PAM authentication failed for user fernsler: Authentication failure, referer: [https://hpcs-oodev8.lbl.gov/pun/sys/dashboard](https://hpcs-oodev8.lbl.gov/pun/sys/dashboard)  
[Mon May 06 11:49:30.632094 2024] [auth\_basic:error] [pid 3835:tid 140102013097728] [client 131.243.153.150:51410] AH01617: user fernsler: authentication failure for “/pun/sys/dashboard/assets/OpenOnDemand\_powered\_by\_RGB-cb3aad5ff5350c7994f250fb334ddcc72e343233ce99eb71fda93beddd76a847.svg”: Password Mismatch, referer: [https://hpcs-oodev8.lbl.gov/pun/sys/dashboard](https://hpcs-oodev8.lbl.gov/pun/sys/dashboard)

Are we just missing an apache directive here or something else?

thanks for any insights,  
-k

---

<div class="post-metadata">

**Author:** ![hrandquist](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/hrandquist/32/2536_2.png) [@hrandquist](https://discourse.openondemand.org/u/hrandquist)\
**Post date:** [May 7, 2024, 2:14pm UTC](https://discourse.openondemand.org/t/mod-authnz-external-and-pam-authentication/3467/4 "2024-05-07T14:14:59Z")

</div>

Hello! I apologize for the delayed reply to this question, I’ve been doing some reading to try to catch up with where you’re at. We generally don’t do support for authentication solutions outside of what we show in the Docs, and we’ve officially decided to not include PAM in our documentation: [rm docs on PAM and leave it to the reader by johrstrom · Pull Request #691 · OSC/ood-documentation · GitHub](https://github.com/OSC/ood-documentation/pull/691)

However, we do have an ongoing conversation about setting up PAM (and why we do not recommend it) with OnDemand here: [Can OOD auth be handled by PAM?](https://discourse.openondemand.org/t/can-ood-auth-be-handled-by-pam/81).

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [May 7, 2024, 2:36pm UTC](https://discourse.openondemand.org/t/mod-authnz-external-and-pam-authentication/3467/5 "2024-05-07T14:36:09Z")

</div>

Yea the question is really more `Does apache support this authentication method`. It’s likely that it does as you mention the mods.

That `we don't support` it is a strong phrase here - we discourage it’s use. It’s really quite insecure.

That said - if you can share the `auth` section of your `ood_portal.yml` we can take a look in replicating to see what your issue may be.

Googling `httpd mod_authnz_external Password Mismatch` does return some results - so that may be helpful to you as well.

---

<div class="post-metadata">

**Author:** ![KMFernsler](https://avatars.discourse-cdn.com/v4/letter/k/258eb7/32.png) [@KMFernsler](https://discourse.openondemand.org/u/KMFernsler)\
**Post date:** [May 7, 2024, 6:56pm UTC](https://discourse.openondemand.org/t/mod-authnz-external-and-pam-authentication/3467/6 "2024-05-07T18:56:20Z")

</div>

Hrandquist and Jeff,

Thanks for your reponses. I agree after messing around with this for awhile the question is really more about apache. If mod\_authnz is completely off the table, please allow me to explain what we need and see if there is a way to accomplish it.

We need to do radius authentication. I have started looking at the LDAP and ondemand dex support for authentication with Open Ondememand, but is there a way to do that with radius/OTP ?

thanks,  
-k

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [May 7, 2024, 7:27pm UTC](https://discourse.openondemand.org/t/mod-authnz-external-and-pam-authentication/3467/7 "2024-05-07T19:27:11Z")

</div>

This is the first time I’ve ever heard of Radius, so you may find more by googling more than I did -

But I’ve found that there is a `mod_auth_raduis` for apache, but apparently it’s not distributed to your OS (or any for that matter). So you likely need to build the `.so` binaries from the source, then you can enable/configure it just like any other apache module.

I found these oracle docs for the same:

> **[Installation Guide](https://docs.oracle.com/en/industries/communications/session-monitor/5.1/installation/configuring-apache-authenticating-radius-server.html)**
>
> This section explains how to configure the external authentication for Session Monitor with the Radius Service using the Apache Web Server.

I found that this may be the source code - other links I’ve found, like the one in the Oracle docs, I’m hesitant to click because I don’t know where/what they are.I assume it’s the source code, but does not seem to be maintained. Last commits were 3 years ago and it seems to have been active 9 years ago.

> **[GitHub - FreeRADIUS/mod\_auth\_radius: The FreeRADIUS Apache module for RADIUS...](https://github.com/FreeRADIUS/mod_auth_radius)**
>
> The FreeRADIUS Apache module for RADIUS authentication - FreeRADIUS/mod\_auth\_radius

---

<div class="post-metadata">

**Author:** ![KMFernsler](https://avatars.discourse-cdn.com/v4/letter/k/258eb7/32.png) [@KMFernsler](https://discourse.openondemand.org/u/KMFernsler)\
**Post date:** [May 7, 2024, 9:04pm UTC](https://discourse.openondemand.org/t/mod-authnz-external-and-pam-authentication/3467/8 "2024-05-07T21:04:37Z")

</div>

Ok, thanks! I’ll give that a try.

-k

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [November 3, 2024, 9:05pm UTC](https://discourse.openondemand.org/t/mod-authnz-external-and-pam-authentication/3467/9 "2024-11-03T21:05:21Z")

</div>

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.