Securid PAM agent for AIX 5.3 - unable to use ldap groups
3 years ago
Originally Published: 2011-04-26
Article Number
000048378
Applies To
AIX 5.3

PAM SecurID agent for AIX

Issue
Securid PAM agent for AIX - unable to use ldap groups with PAM agent on AIX

Cause
IBM has chosen a LAM vs straight PAM model for LDAP.  IBM has only recently documented the limitation of its system calls with PAM and ldap, see IBM APAR (bug report)

https://www-304.ibm.com/support/docview.wss?uid=isg1IZ89143

IZ89143: DOC DOES NOT SAY THAT GETGRENT AND GETPWENT DOES NOT SUPPORT LAM

Under the AIX LAM model, you cannot use GETGRENT() and GETPWENT() standard unix system calls to traverse groups and users when ldap is used.
This differs from RHEL, Solaris, HPUX and SuSe, which are the other platforms the RSA PAM agent can be leveraged against.   This behavior was only recently documented by IBM.

Resolution
RSA has released a new PAM module which accomodates the newly documented limitations of the AIX LAM module.  Please use AIX PAM kit 7.0.2 (to be officially released as a full kit beginning June 2011 and publicly available for download at http://www.rsa.com/node.aspx?id=1177 ).

Notes
Note, LAM support is available until AIX 5.3, therefore you cannot use ldap groups with AIX 5.2.  This is not an RSA PAM module limitation, it is a limitation of AIX.

Don't see what you're looking for?