2.1 Authenticating a domain user on a non-domain Linux machine

To authenticate a domain user on a Linux machine in non-domain mode, you must configure the Linux machine to use the Advanced Authentication in non-domain mode.

This setup allows users to authenticate through Advanced Authentication directly, without relying on domain controllers.

2.1.1 Prerequisites

Ensure the following prerequisites are met before you configure the Linux machine:

Open the SSH terminal.
During installation of Linux PAM client, run the following commands for non-domain joined machine:

NOTE:Ensure to set Event type as OS logon (local) in the Linux logon event for the Linux machine that is not joined to a domain.
1. CentOS and Red Hat Enterprise Linux:
  
  sudo chmod +x /opt/pam_aucore/bin/bind-to-nondomain.sh
  
  sudo /opt/pam_aucore/bin/bind-to-nondomain.sh
2. SUSE Linux enterprise Desktop and server:
  
  sudo /opt/pam_aucore/bin/activate-nondomain.sh
3. Ubuntu and Debian:
  
  sudo chmod +x /opt/pam_aucore/bin/activate-nondomain.sh
  
  sudo /opt/pam_aucore/bin/activate-nondomain.sh
Make sure to add the discovery.host property in the /opt/pam_aucore/etc/pam_aucore.config file. For more information, see Using a specific Advanced Authentication server in Non-DNS mode.

NOTE:The value of this property must match the URL specified in the Public External URLs policy.
Make sure to set the following properties in the /etc/ssh/sshd_config file:
1. Set the PasswordAuthentication parameter to no
2. Set the ChallengeResponseAuthentication parameter to yes
  
  IMPORTANT:For Red Hat Enterprise Linux, set the ChallengeResponseAuthentication parameter to yes in the /etc/ssh/sshd_config.d/50-redhat.conf path in addition to above configuration.
To apply the changes in the sshd_config file, you must restart the SSH Service. To restart the SSH Service, run the command sudo service sshd restart in the terminal.

2.1.2 Configuring the Linux machine

To configure the Linux machine to use Advanced Authentication in non-domain mode, perform the following:

Create a local user with a username that matches a user in OpenText Advanced Authentication.
Set a password for the local user.

NOTE:The password does not need to match the one in the LDAP directory.
Perform one of the following steps:
1. Add the local user to the required group specified in the pam_aucore.conf file, to bypass local authentication and allow Advanced Authentication to manage the login process.
  
  To add a local user in the specific group, perform the following:
  1. Navigate to /opt/pam_aucore/etc/ and open the pam_aucore.conf file.
  2. Specify aauth.group:<groupname>.
  3. In the SSH terminal, run the following command to Add the user to the specified group:
    
    Linux:
    
    usermod -aG <groupname> <username>
    
    AIX:
    
    usermod -G <groupname> <username>
2. Lock the local user account using the following command:
  
  NOTE:On CentOS and RHEL, the security-enhanced module (SELinux) prevents Advanced Authentication from reading the shadow file.
  
  To bypass this issue, set the SELINUX=permissive parameter in the /etc/selinux/config file.
  
  This is not a recommended solution. For more secure alternatives, refer to the SELinux User's and Administrator's Guide.
  1. Linux:
    
    usermod -L <username>
  2. AIX:
    
    chuser login=false <username>
3. Configure the user’s shell to invoke Advanced Authentication directly.
  
  To update the user's shell, perform the following steps:
  1. On Linux machine, change the user’s shell in /etc/passwd to one of the following:
    
    /bin/aauth or /usr/bin/aauth
  2. Create the aauth symbolic link pointing to either /bin or /usr/bin.
    
    For example, ln -s /usr/bin/bash /usr/bin/aauth
Login to the non-domain Linux machine using the local username.

NOTE:The AIX system may prompt the local user to reset their password during the first login.