Pluggable Authentication Module

The Pluggable Authentication Module (PAM) is an authentication tool that allows users to use their network password with the sudo command rather than their local password. PAM is included in all installations of Jamf Connect and stored on computers in the following location:

/usr/local/lib/pam/pam_saml.so.2

Important:

Make sure to test workflows with the PAM in an environment other than your production environment.

Enabling the Pluggable Authentication Module

  1. Execute the following authchanger command to enable PAM authentication with Jamf Connect: 
    /usr/local/bin/authchanger -DefaultJCRight
  2. In Terminal, access the PAM configuration profile by executing the following command: 
    sudo vi /etc/pam.d/sudo
  3. Enter your local password.
  4. Enter edit mode and do one of the following:
    Note:

    A warning may display when attempting to edit a read-only file. Continue to edit the file, and then refer to step 5 to save your changes.

    1. To allow (but not require) network authentication for sudo commands, add the following entry:
      auth sufficient pam_saml.so

    2. To require network authentication for sudo commands, do the following:

      Add the following entry:

      auth required pam_saml.so

      Comment out the pam_opendirectory.so entry by adding a pound symbol (#) at the beginning of that line.

  5. Press the Escape key to exit the editor mode, and then write and quit the read-only file by executing the following command at the bottom of the Terminal window: :wq!

    Your cursor automatically moves to the bottom of the Terminal window after you exit editor mode.

  6. Configure PAM module preferences in your login window configuration profile.

The PAM module should now prompt users to authenticate with your IdP any time a sudo command is attempted.

Pluggable Authentication Module End User Experience

If the Pluggable Authentication Module (PAM) is enabled, you can use the sudo command to authenticate with your cloud identity provider (IdP).

  1. In Terminal, execute any sudo command, such as the following:
    sudo -s
    Your IdP's login screen should display.
  2. Enter your network username and password to authenticate.
    Note:

    If you configured network authentication to be sufficient but not required, closing the login window will cause macOS to prompt you to enter your password in Terminal instead. If you configured network authentication to be required, closing the login window will cause authentication to fail.

    Once authenticated, the sudo command should successfully execute in Terminal.