<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">I wanted to report back that I’ve verified it’s possible to use Keycloak and Duo by having Keycloak perform authentication through SSSD running on the Keycloak server. I followed the Keycloak docs for using
SSSD [1] except for a modified /etc/pam.d/keycloak [2]. I verified that setting something like 'groups=*,!root’ in /etc/duo/pam_duo.conf and the PAM config was enough to require Duo. If you wanted to make Duo optional you could do so via group memberships
and I verified this works by changing groups config for pam_duo. You could also do clever things with the PAM stack to use pam_duo based on other conditions. Because Keycloak doesn’t actually know there is a possible challenge response using SSSD you have
to setup Duo to have autopush=yes and prompts=1 so that the 2FA automatically sends a push notification to the person’s phone.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">If more details are needed let me know and I can provide my exact steps taken to get Duo and Keycloak working together.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">- Trey<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">[1]:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><a href="https://www.keycloak.org/docs/latest/server_admin/index.html#sssd-and-d-bus">https://www.keycloak.org/docs/latest/server_admin/index.html#sssd-and-d-bus</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">[2]:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">auth required pam_sss.so<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">auth required pam_duo.so<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">account required pam_sss.so<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">-- <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Trey Dockendorf<o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">HPC Systems Engineer<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Ohio Supercomputer Center</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:black">From: </span></b><span style="color:black">OOD-users <ood-users-bounces+tdockendorf=osc.edu@lists.osc.edu> on behalf of "Lilley, John F. via OOD-users" <ood-users@lists.osc.edu><br>
<b>Reply-To: </b>"Lilley, John F." <johnbot@caltech.edu>, User support mailing list for Open OnDemand <ood-users@lists.osc.edu><br>
<b>Date: </b>Tuesday, December 11, 2018 at 5:13 PM<br>
<b>To: </b>"ood-users@lists.osc.edu" <ood-users@lists.osc.edu><br>
<b>Subject: </b>[OOD-users] Open OnDemand with LDAP/Duo auth<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt">Hello All, </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Performing a test installation of Open OnDemand on our central hpc to compare performance and functionality against StarNet FastX. We use ldap along with duo as the second factor. Does OpenOndemand support
this type of installation and if so, are there documents/notes/wikis describing this configuration floating around?</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thank You,</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">John</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">-- </span><o:p></o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt">John Lilley</span></b><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt">C A L I F O R N I A I N S T I T U T E O F T E C H N O L O G Y</span></b><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Lead Systems Administrator – Cloud and High Performance Computing | IMSS</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><a href="mailto:nelsonhs@caltech.edu">johnbot@caltech.edu</a> | 323.208.1688</span><o:p></o:p></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
</div>
</body>
</html>