After asking Delinea PAM admin, i was updated that this solution provides an API (PowerShell, .NET) that can retrieve PAM user password (each AD user is bound to its corresponding PAM secret). So, how can we pass this PAM user (secret) password to the MQ Explorer?
Original Message:
Sent: Wed December 06, 2023 10:57 AM
From: NICK DAKORONIAS
Subject: MQ Explorer integration with Delinea PAM solution
It is true that Pluggable Authentication Module (PAM) integrates smoothly with Linux / Unix, given that both platforms have the proper (PAM) modules to support this authentication mechanism. The problem in our case is that Delinea PAM solution has been implemented in order to integrate ONLY with Windows platform and specifically Active Directory authentication mechanisms (LDAP/Kerberos), at least at the initial stage, as we stand, upon organization's management team decision.
I will ask Delinea PAM admin and come back about the way the Delinea software retrieves and handles AD user's password token.
------------------------------
Nick Dakoronias
------------------------------
Original Message:
Sent: Wed December 06, 2023 09:41 AM
From: Francois Brandelik
Subject: MQ Explorer integration with Delinea PAM solution
And how does that integrate with Linux/Unix if not through the Plug-able Authentication Module?
On the other hand I would expect the Privileged Access Management system to have a way to retrieve a password if given certain credentials, like say an Active Directory user name and password / access token...
------------------------------
Francois Brandelik
Original Message:
Sent: Wed December 06, 2023 09:31 AM
From: NICK DAKORONIAS
Subject: MQ Explorer integration with Delinea PAM solution
I have explicitly specified in my initial post that PAM refers on Privileged Access Management and Delinea PAM has been chosen to be the core solution for Privileged Access Management Authentication.
------------------------------
Nick Dakoronias
Original Message:
Sent: Wed December 06, 2023 04:53 AM
From: Mayur RAJA
Subject: MQ Explorer integration with Delinea PAM solution
Be careful, PAM can mean
------------------------------
Mayur RAJA
Original Message:
Sent: Wed December 06, 2023 02:37 AM
From: Francois Brandelik
Subject: MQ Explorer integration with Delinea PAM solution
I hear ans see the word PAM in your authentication solution.
Make sure the MQ authentication record is not the default one, and that the authenmd is not OS but PAM. This would look like:
DEFINE AUTHINFO(COMPANY.AUTHINFO.IDPWOS) AUTHTYPE(IDPWOS) LIKE (SYSTEM.DEFAULT.AUTHINFO.IDPWOS) ADOPTCTX(YES) CLNTCHECK(REQDADM) AUTHENMD(PAM)ALTER QMGR CONNAUTH(COMPANY.AUTHINFO.IDPWOS)REFRESH SECURITY TYPE(CONNAUTH)
This way when you supply the password it can be verified. (remove compatibility check on MQE, with compatibility checked, the password could be truncated at 16 chars)
Of course another possibility would be to install an X11 Server on your windows machine (Xming)(make sure to check the remove access control on launch), access the Linux/Unix server via the new mechanism, set the DISPLAY variable and run the MQ Explorer locally getting the rendering done in your X11 Server
Hope this helps
------------------------------
Francois Brandelik
Original Message:
Sent: Wed December 06, 2023 02:08 AM
From: Mark Taylor
Subject: MQ Explorer integration with Delinea PAM solution
You can choose NOT to store passwords to the file that Explorer uses, in which case you enter it each time you connct.
An alternative might be to write and configure a security exit that modifies the password during connection. One recently-released example of a Java security exit is here. That sample is obtaining/passing a token instead of a password, but the basic structure would be the same. Where the exits picks up your password would then be entirely up to you
------------------------------
Mark Taylor
Winchester