# Reinstallation - PAM authentication not working - RHEL 8.5

**URL:** <https://discourse.openondemand.org/t/reinstallation-pam-authentication-not-working-rhel-8-5/2093>\
**Category:** Get Help\
**Tags:** question\
**Created:** [June 1, 2022, 4:01pm UTC](https://discourse.openondemand.org/t/reinstallation-pam-authentication-not-working-rhel-8-5/2093 "2022-06-01T16:01:44Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![equiros-sfwmd](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/equiros-sfwmd/32/979_2.png) [@equiros-sfwmd](https://discourse.openondemand.org/u/equiros-sfwmd)\
**Post date:** [June 1, 2022, 4:01pm UTC](https://discourse.openondemand.org/t/reinstallation-pam-authentication-not-working-rhel-8-5/2093/1 "2022-06-01T16:01:44Z")

</div>

Hello,  
Doing another installation of OOD, following my previous installations.  
I am trying to authenticate using PAM. Followed the instructions at:  
_[Add PAM Authentication — Open OnDemand 2.0.20 documentation](https://osc.github.io/ood-documentation/latest/authentication/pam.html)_

However, whenever I try to login, I only get back to the login screen.  
I tried ood@localhost, as well as other users (myself) that work fine with SSH on that box.

Whenever I enter the username by itself, it tells me “Failed to map user”, which is expected.

I’m sure I’m missing a small critical piece of this process.  
The Apache module is installed as mod\_authnz\_pam.  
And the HTTP service gives me error messages like this:  
_Jun 01 11:12:58 log01 httpd[109384]: pam\_unix(ood:auth): check pass; user unknown_  
_Jun 01 11:12:58 log01 httpd[109384]: pam\_unix(ood:auth): authentication failure; logname= uid=48 euid=48 tty= ruser= rhost=10.17.0.186_

Does it think that the ood user is UID 48? It isn’t. What am I missing ?

---

<div class="post-metadata">

**Author:** ![gbyrket](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/gbyrket/32/894_2.png) [@gbyrket](https://discourse.openondemand.org/u/gbyrket)\
**Post date:** [June 1, 2022, 4:29pm UTC](https://discourse.openondemand.org/t/reinstallation-pam-authentication-not-working-rhel-8-5/2093/2 "2022-06-01T16:29:53Z")

</div>

Hi Equiros.

Thanks for the post.

I have some good news for you on this one. It appears I have a discourse topic that will answer this question for you.

> [@Failed to map user PAM authentication](https://discourse.openondemand.org/t/failed-to-map-user-pam-authentication/2021):
>
> Hi All, I’m in the middle of a new installation and have just configured our system for PAM authentication. I’m able to get to the login screen and enter a user’s credentials just username and password (no email). Then I get the following that others have seen. "Error – failed to map user (nortech) I’ve been doing some reading on the forms and it appears that many others have run across this issue and most have ended up using a different type of authentication procedure to get around the iss…

It is a fairly long back and forth. If you look toward the bottom of the topic, you will find, what I believe will be your answer.

If that topic does not fix the issue, please let use know.

Thanks,  
-gerald

---

<div class="post-metadata">

**Author:** ![equiros-sfwmd](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/equiros-sfwmd/32/979_2.png) [@equiros-sfwmd](https://discourse.openondemand.org/u/equiros-sfwmd)\
**Post date:** [June 2, 2022, 1:35pm UTC](https://discourse.openondemand.org/t/reinstallation-pam-authentication-not-working-rhel-8-5/2093/3 "2022-06-02T13:35:16Z")

</div>

Hello Again,  
Thanks for that info. The actual issue I am experiencing is that authentication is not working at all for the moment. For now, I am trying to log in as the default ood user. This user has no SSH password set in the system, but the ood user exists. I try to log into the newly created system as “ood@localhost” with the default “password” as the pw, but I just get returned to the login screen. Not sure what I could be missing.

---

<div class="post-metadata">

**Author:** ![gbyrket](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/gbyrket/32/894_2.png) [@gbyrket](https://discourse.openondemand.org/u/gbyrket)\
**Post date:** [June 6, 2022, 1:12pm UTC](https://discourse.openondemand.org/t/reinstallation-pam-authentication-not-working-rhel-8-5/2093/4 "2022-06-06T13:12:59Z")

</div>

Hi Equiros.

Sorry for the late response here. I’m going to have to look into it. I’m not sure what might going on off the top of my head.

Thanks,  
-gerald

---

<div class="post-metadata">

**Author:** ![equiros-sfwmd](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/equiros-sfwmd/32/979_2.png) [@equiros-sfwmd](https://discourse.openondemand.org/u/equiros-sfwmd)\
**Post date:** [June 6, 2022, 1:16pm UTC](https://discourse.openondemand.org/t/reinstallation-pam-authentication-not-working-rhel-8-5/2093/5 "2022-06-06T13:16:14Z")

</div>

Thanks Gerald,  
I notice that the error message says unknown user with UID 48, which happens to be the UID of Apache. Not sure why it is not using the UID of the login user.

---

<div class="post-metadata">

**Author:** ![equiros-sfwmd](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/equiros-sfwmd/32/979_2.png) [@equiros-sfwmd](https://discourse.openondemand.org/u/equiros-sfwmd)\
**Post date:** [June 6, 2022, 6:53pm UTC](https://discourse.openondemand.org/t/reinstallation-pam-authentication-not-working-rhel-8-5/2093/6 "2022-06-06T18:53:24Z")

</div>

In trying to replicate the install process, I started fresh on a new RHEL 8 system  
These are the steps I have taken. It currently produces an internal server error (500).

I know we’ve solved this before, I just don’t remember what was done.  
This is what I did on the new system, following the instructions line by line.

**Enable the modules and install the packages**  
yum module enable ruby:2.7  
yum module enable nodejs:12  
yum install ondemand ondemand-dex

**Add OOD user**  
groupadd ood  
useradd -d /home/ood -g ood -k /etc/skel -m ood

**Start Services and update ood portal**  
systemctl start ondemand-dex  
systemctl start httpd  
/opt/ood/ood-portal-generator/sbin/update\_ood\_portal

This is BEFORE trying to configure PAM for authentication.  
If I add the PAM configuration and reload the portal,  
I get a login screen, but cannot authenticate.  
Just looking to allow the ood user to login to the dashboard for now.  
I’m sure I’m missing something, just don’t know what it could be.

---

<div class="post-metadata">

**Author:** ![gbyrket](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/gbyrket/32/894_2.png) [@gbyrket](https://discourse.openondemand.org/u/gbyrket)\
**Post date:** [June 6, 2022, 7:28pm UTC](https://discourse.openondemand.org/t/reinstallation-pam-authentication-not-working-rhel-8-5/2093/7 "2022-06-06T19:28:02Z")

</div>

The internal error is usually related to the hostname being different than the host in your url. The log files should give you the exact error.

As for the authentication issue. I’m not sure. It may be necessary to try a screen share and see if we can figure it out. Are you willing to do that?

---

<div class="post-metadata">

**Author:** ![equiros-sfwmd](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/equiros-sfwmd/32/979_2.png) [@equiros-sfwmd](https://discourse.openondemand.org/u/equiros-sfwmd)\
**Post date:** [June 6, 2022, 8:03pm UTC](https://discourse.openondemand.org/t/reinstallation-pam-authentication-not-working-rhel-8-5/2093/8 "2022-06-06T20:03:04Z")

</div>

On the test system, the hostname is the same as the server name  
Ok, on the login node, its a bit different, because I wanted to use the IB hostname.

A screen share would be great.  
Can we schedule something for tomorrow ?

---

<div class="post-metadata">

**Author:** ![gbyrket](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/gbyrket/32/894_2.png) [@gbyrket](https://discourse.openondemand.org/u/gbyrket)\
**Post date:** [June 7, 2022, 11:29pm UTC](https://discourse.openondemand.org/t/reinstallation-pam-authentication-not-working-rhel-8-5/2093/9 "2022-06-07T23:29:21Z")

</div>

Hi Al.

I am able to recreate the issue you are having. I will look into it tonight, but just a reminder, I will not be back in the office until Monday most likely.

---

<div class="post-metadata">

**Author:** ![gbyrket](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/gbyrket/32/894_2.png) [@gbyrket](https://discourse.openondemand.org/u/gbyrket)\
**Post date:** [June 8, 2022, 12:23am UTC](https://discourse.openondemand.org/t/reinstallation-pam-authentication-not-working-rhel-8-5/2093/10 "2022-06-08T00:23:18Z")

</div>

Hey Al.

I have it fixed via work-around. I should have the problem solved shortly. Hopefully. 🙂

---

<div class="post-metadata">

**Author:** ![gbyrket](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/gbyrket/32/894_2.png) [@gbyrket](https://discourse.openondemand.org/u/gbyrket)\
**Post date:** [June 8, 2022, 12:30am UTC](https://discourse.openondemand.org/t/reinstallation-pam-authentication-not-working-rhel-8-5/2093/11 "2022-06-08T00:30:00Z")

</div>

It appears that update\_ood\_portal is not updating this specific entry in the related apache configuration file.

to work around, you can do the following:

vi /etc/httpd/conf.d/ood-portal.conf

search for the entry  
SetEnv OOD\_USER\_MAP\_MATCH “^([^@]+)@.\*$”

replace entry with  
SetEnv OOD\_USER\_MAP\_MATCH “.\*”

then restart apache with the following command:  
sudo systemctl try-restart httpd.service htcacheclean.service

Again. This is just a work-around to get you going. When I’m back in the office, I will continue to search for a solid solution for you.

thanks,  
-gerald

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [June 8, 2022, 1:15pm UTC](https://discourse.openondemand.org/t/reinstallation-pam-authentication-not-working-rhel-8-5/2093/12 "2022-06-08T13:15:34Z")

</div>

There is different behaviour when you have `ondemand-dex` installed. You have it installed, so we assumed you’re using it and do a few things automatically.

Remove `ondemand-dex` RPM and we’ll stop making that assumption.

That said - we’re dropping support for PAM because it is so very incredibly insecure. Dex is a very good option if you have an LDAP to connect to.

---

<div class="post-metadata">

**Author:** ![equiros-sfwmd](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/equiros-sfwmd/32/979_2.png) [@equiros-sfwmd](https://discourse.openondemand.org/u/equiros-sfwmd)\
**Post date:** [June 8, 2022, 2:12pm UTC](https://discourse.openondemand.org/t/reinstallation-pam-authentication-not-working-rhel-8-5/2093/13 "2022-06-08T14:12:25Z")

</div>

Hi Jeff,  
PAM is a temporary solution while we implement our Identity Management solution.

---

<div class="post-metadata">

**Author:** ![gbyrket](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/gbyrket/32/894_2.png) [@gbyrket](https://discourse.openondemand.org/u/gbyrket)\
**Post date:** [June 9, 2022, 1:28am UTC](https://discourse.openondemand.org/t/reinstallation-pam-authentication-not-working-rhel-8-5/2093/14 "2022-06-09T01:28:45Z")

</div>

@jeff.ohrstrom

Thanks for the help there. Is that documented in the current documentation and I just missed it?

Thanks,  
-gerald

---

<div class="post-metadata">

**Author:** ![equiros-sfwmd](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/equiros-sfwmd/32/979_2.png) [@equiros-sfwmd](https://discourse.openondemand.org/u/equiros-sfwmd)\
**Post date:** [June 9, 2022, 12:20pm UTC](https://discourse.openondemand.org/t/reinstallation-pam-authentication-not-working-rhel-8-5/2093/15 "2022-06-09T12:20:49Z")

</div>

Thanks to Jeff and Gerald, we are able to authenticate again.  
Yes, we are still using PAM for this proof of concept. 😨  
However, once our IdM system is up we will switch to LDAP.

Thank you Both !

---

<div class="post-metadata">

**Author:** ![gbyrket](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/gbyrket/32/894_2.png) [@gbyrket](https://discourse.openondemand.org/u/gbyrket)\
**Post date:** [June 9, 2022, 12:28pm UTC](https://discourse.openondemand.org/t/reinstallation-pam-authentication-not-working-rhel-8-5/2093/16 "2022-06-09T12:28:58Z")

</div>

Hey Al.

Don’t worry. LDAP is much easier to setup.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [December 6, 2022, 12:29pm UTC](https://discourse.openondemand.org/t/reinstallation-pam-authentication-not-working-rhel-8-5/2093/17 "2022-12-06T12:29:11Z")

</div>

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.