Allow non-root processes to use the PAM service

cmd/authd/daemon/daemon.go

@@ -10,6 +10,7 @@ import (
 	"github.com/canonical/authd/internal/daemon"
 	"github.com/canonical/authd/internal/decorate"
 	"github.com/canonical/authd/internal/services"
+	"github.com/canonical/authd/internal/services/pam"
 	"github.com/canonical/authd/internal/users"
 	"github.com/canonical/authd/log"
 	"github.com/spf13/cobra"
@@ -46,6 +47,7 @@ type daemonConfig struct {
 	Verbosity   int
 	Paths       systemPaths
 	UsersConfig *users.Config `mapstructure:",squash" yaml:",inline"`
+	PAMConfig   *pam.Config   `mapstructure:",squash" yaml:",inline"`
 }
 
 type options struct {
@@ -91,6 +93,7 @@ func New(args ...Option) *App {
 					Socket:      "",
 				},
 				UsersConfig: &users.DefaultConfig,
+				PAMConfig:   &pam.DefaultConfig,
 			}
 
 			// Install and unmarshall configuration
@@ -152,7 +155,12 @@ func (a *App) serve(config daemonConfig) error {
 		panic("Users config must be set! This is a programmer error.")
 	}
 
-	m, err := services.NewManager(ctx, dbDir, config.Paths.BrokersConf, config.Brokers, *config.UsersConfig)
+	if config.PAMConfig == nil {
+		// This is an assert, since we assume that the daemonConfig on [New] is properly defined.
+		panic("PAM config must be set! This is a programmer error.")
+	}
+
+	m, err := services.NewManager(ctx, dbDir, config.Paths.BrokersConf, config.Brokers, *config.UsersConfig, *config.PAMConfig)
 	if err != nil {
 		close(a.ready)
 		return err

debian/authd-config/authd.yaml

@@ -22,3 +22,20 @@
 #UID_MAX: 60000
 #GID_MIN: 10000
 #GID_MAX: 60000
+
+## Brute-force mitigation settings for authentication failures.
+## To disable brute-force mitigation entirely, set auth_fail_delay to 0.
+##
+## auth_fail_delay_threshold: number of consecutive failures for a single user
+## before a delay is imposed on subsequent attempts.
+#auth_fail_delay_threshold: 3
+##
+## auth_fail_delay: duration of the delay imposed once the threshold is reached.
+## Accepts durations like "2s", "500ms", "1m".
+#auth_fail_delay: 2s
+##
+## auth_fail_reset_window: duration of inactivity after the last failure before
+## the failure count is automatically reset.
+## Accepts durations like "15m", "1h", "30s". Set to 0 to keep failures
+## accumulated indefinitely (no inactivity reset).
+#auth_fail_reset_window: 15m

internal/brokers/manager.go

@@ -26,6 +26,7 @@ type Manager struct {
 	usersToBrokerMu sync.RWMutex
 
 	transactionsToBroker   map[string]*Broker
+	sessionsToUsername     map[string]string
 	transactionsToBrokerMu sync.RWMutex
 
 	cleanup func()
@@ -112,6 +113,7 @@ func NewManager(ctx context.Context, brokersConfPath string, configuredBrokers [
 
 		usersToBroker:        make(map[string]*Broker),
 		transactionsToBroker: make(map[string]*Broker),
+		sessionsToUsername:   make(map[string]string),
 
 		cleanup: cleanup,
 	}, nil
@@ -180,6 +182,7 @@ func (m *Manager) NewSession(brokerID, username, lang, mode, providerID string)
 	log.Debugf(context.Background(), "%s: New %s session for %q",
 		sessionID, mode, username)
 	m.transactionsToBroker[sessionID] = broker
+	m.sessionsToUsername[sessionID] = username
 	return sessionID, encryptionKey, nil
 }
 
@@ -197,12 +200,20 @@ func (m *Manager) EndSession(sessionID string) error {
 
 	m.transactionsToBrokerMu.Lock()
 	log.Debugf(context.Background(), "%s: End session %q",
-		sessionID, m.transactionsToBroker[sessionID].Name)
+		sessionID, b.Name)
 	delete(m.transactionsToBroker, sessionID)
+	delete(m.sessionsToUsername, sessionID)
 	m.transactionsToBrokerMu.Unlock()
 	return nil
 }
 
+// UsernameFromSessionID returns the username associated with the given session ID.
+func (m *Manager) UsernameFromSessionID(sessionID string) string {
+	m.transactionsToBrokerMu.RLock()
+	defer m.transactionsToBrokerMu.RUnlock()
+	return m.sessionsToUsername[sessionID]
+}
+
 // BrokerExists returns true if the brokerID is known by the manager.
 func (m *Manager) BrokerExists(brokerID string) bool {
 	_, exists := m.brokers[brokerID]