Authentication
Self-hosted Landscape supports a few methods of authentication for its web interface.
PAM Support
If you want to use Pluggable Authentication Modules (PAM) to authenticate users in your new Landscape server you must create the file /etc/pam.d/landscape
with the appropriate PAM configuration.
The simplest possible file is:
#%PAM-1.0 auth required pam_permit.so account required pam_permit.so
Do NOT use this PAM setup on a production environment
This allows any user to login without validating the password.
We have tested PAM authentication against an LDAP server running on Ubuntu, and against Windows AD authentication.
If you use PAM to authenticate, the user details stored in Landscape are associated with the PAM identity supplied.
For more information on PAM authentication see PAM Tutorial.
OpenID-Connect Support
Landscape can use OpenID-Connect (OIDC) to authenticate users. To enable OpenID-Connect support, please add oidc-issuer
, oidc-client-id
and oidc-client-secret
to /etc/landscape/service.conf
in the [landscape]
section. For example:
[landscape]
[…]
oidc-issuer = https://accounts.google.com/ oidc-client-id = 000000000000-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.apps.googleusercontent.com oidc-client-secret = a4sDFAsdfA4F52as-asDfAsd
The oidc-issuer
is the URL of the issuer. That URL should also be a discovery configuration file available by appending .well-known/openid-configuration
, such as https://accounts.google.com/.well-known/openid-configuration. The oidc-client-id
and oidc-client-secret
should be provided by the OpenID-Connect provider when you create the client credentials. The provider may require setting an authorization redirect URI. This should look like https://your_landscape/login/handle-openid
. If your provider also requires a logout redirect URL, this should be the address of your Landscape server such as https://your_landscape/
.
After making these changes, restart all Landscape services:
sudo lsctl restart
Optionally, a logout URL can be configured in case the provider does not expose one. It can be configured like so:
[landscape] … oidc-logout-url = https://accounts.google.com/logout