The PAM API is used to create target accounts, but the following error occurs when trying to create a Unix target account with an SSH key.
{
"error": {
"code": 400,
"message": "Bad Request: PAM-CMN-0467: A Password Authority problem prevented completing the request. Message: No response from Password Authority. Check log for details."
}
}
This is the API body used to create the account.
{
"accountName":"sshkeyaccount",
"aliasNames":null,
"attributes":{
"protocol": "SSH2_PUBLIC_KEY_AUTH",
"verifyThroughOtherAccount": "false",
"extensionType": "unixII",
"passphrase": "<passphrase>",
"keyoptions": null,
"publicKey":"<base64pubkey>",
"privateKey": "<base64privkey>",
"useOtherAccountToChangePassword":"false",
"otherAccount":null
},
"cacheBehavior":"useCacheFirst",
"cacheDuration":"30",
"description1":"LINUX",
"description2":null,
"password":"<base64privkey>",
"passwordViewPolicyId":null,
"privileged":"t",
"synchronize":"f",
"useAliasNameParameter":null,
"passwordIsBase64Encoded":"t"
}
Privileged Access Manager, all versions
In order to pass the SSH public and private keys using the API, the keys must first be base64 encoded. In this case, the following commands were used in Powershell to encode the SSH keys with Unicode encoding. As a result, there were null characters when PAM decoded the SSH keys, causing the function to break.
$Text = ‘public/private SSH key text’
$Bytes = [System.Text.Encoding]::Unicode.GetBytes($Text)
$EncodedText =[Convert]::ToBase64String($Bytes)
$EncodedText
For best results, it is advised to use openssl to encode the SSH keys. If openssl is unavailable in the environment, use the following Powershell commands to encode the SSH keys using UTF8 encoding.
$Text = ‘public/private SSH key text’
$Bytes = [System.Text.Encoding]::UTF8.GetBytes($Text)
$EncodedText =[Convert]::ToBase64String($Bytes)
$EncodedText
For information about all options which could be used in the API for SSH key accounts, please refer to the following KB article.
https://knowledge.broadcom.com/external/article?articleId=190503