How does oscomponent.pamlogin.enable=true and oscomponent.pamlogin.svc=su parameters work?

Products

• CA Workload Automation AE - Business Agents (AutoSys)
• CA Workload Automation AE - Scheduler (AutoSys)
• CA Workload Automation Agent

Issue/Introduction

When the following parameters are set in agentparm.txt file of the agent:

oscomponent.pamlogin.enable=true

oscomponent.pamlogin.svc=su

 then jobs can be run without the need to specify the user password. How does it work?

 

 

Environment

Workload Automation AE 11.3.6 Release

Resolution

Without setting the above “pamlogin” parameters in the agentparm.txt, the agent does not log the user into the system to run the job.

Instead, the agent makes the system call "setuid" to change the owner of the running process.

This does not do any of the things that happen when a user logs in.

 

With “pamlogin” parameters set, we login with PAM and let the PAM modules determine how the login is handled and how to modify user permissions and/or environment.

The "su" PAM module is configured to act just like typing "su" at the command line.

When it is run by root, no password is required.

However, it is also configured to load the user's ulimit configuration values.