PAM-CMN-0467 when using Rest API to create Unix account with SSH key

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

The PAM Rest API is used to create target accounts, but the following error occurs when trying to create a Unix target account with an SSH key.

{
  "error": {
    "code": 400,
    "message": "Bad Request: PAM-CMN-0467: A Password Authority problem prevented completing the request. Message: No response from Password Authority. Check log for details."
  }
}

This is the API body used to create the account.

{
    "accountName":"sshkeyaccount",
    "aliasNames":null,
    "attributes":{
        "protocol": "SSH2_PUBLIC_KEY_AUTH",
        "verifyThroughOtherAccount": "false",
        "extensionType": "unixII",
        "passphrase": "<passphrase>",
        "keyoptions": null,
        "publicKey":"<base64pubkey>",
        "privateKey": "<base64privkey>",
        "useOtherAccountToChangePassword":"false",
         "otherAccount":null
                    },
    "cacheBehavior":"useCacheFirst",
    "cacheDuration":"30",
    "description1":"LINUX",
    "description2":null,
    "password":"<base64privkey>",
    "passwordViewPolicyId":null,
    "privileged":"t",
    "synchronize":"f",
    "useAliasNameParameter":null,
    "passwordIsBase64Encoded":"t"
}

Cause

In order to pass the SSH public and private keys using the API, the keys must first be base64 encoded. In this case, the following commands were used in Powershell to encode the SSH keys with Unicode encoding. As a result, there were null characters when PAM decoded the SSH keys, causing the function to break.

$Text = ‘public/private SSH key text’
$Bytes = [System.Text.Encoding]::Unicode.GetBytes($Text)
$EncodedText =[Convert]::ToBase64String($Bytes)
$EncodedText 

Resolution

For best results, it is advised to use openssl to encode the SSH keys. If openssl is unavailable in the environment, use the following Powershell commands to encode the SSH keys using UTF8 encoding.

$Text = ‘public/private SSH key text’
$Bytes = [System.Text.Encoding]::UTF8.GetBytes($Text)
$EncodedText =[Convert]::ToBase64String($Bytes)
$EncodedText