{"action":"created","issue":{"url":"https://api.github.com/repos/duosecurity/duo_unix/issues/62","labels_url":"https://api.github.com/repos/duosecurity/duo_unix/issues/62/labels{/name}","comments_url":"https://api.github.com/repos/duosecurity/duo_unix/issues/62/comments","events_url":"https://api.github.com/repos/duosecurity/duo_unix/issues/62/events","html_url":"https://github.com/duosecurity/duo_unix/pull/62","id":60175820,"number":62,"title":"add support for a file which maps from system usernames to duo usernames","user":{"login":"Roguelazer","id":263424,"avatar_url":"https://avatars.githubusercontent.com/u/263424?v=3","gravatar_id":"","url":"https://api.github.com/users/Roguelazer","html_url":"https://github.com/Roguelazer","followers_url":"https://api.github.com/users/Roguelazer/followers","following_url":"https://api.github.com/users/Roguelazer/following{/other_user}","gists_url":"https://api.github.com/users/Roguelazer/gists{/gist_id}","starred_url":"https://api.github.com/users/Roguelazer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Roguelazer/subscriptions","organizations_url":"https://api.github.com/users/Roguelazer/orgs","repos_url":"https://api.github.com/users/Roguelazer/repos","events_url":"https://api.github.com/users/Roguelazer/events{/privacy}","received_events_url":"https://api.github.com/users/Roguelazer/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-03-06T23:47:32Z","updated_at":"2015-03-10T14:08:41Z","closed_at":"2015-03-10T14:08:41Z","pull_request":{"url":"https://api.github.com/repos/duosecurity/duo_unix/pulls/62","html_url":"https://github.com/duosecurity/duo_unix/pull/62","diff_url":"https://github.com/duosecurity/duo_unix/pull/62.diff","patch_url":"https://github.com/duosecurity/duo_unix/pull/62.patch"},"body":"Our corporate duo accounts (managed by the IT team) have the \"username\" set to our fully-qualified email addresses. Rather than getting IT to change all of our Duo accounts, I'm leaning toward just getting our servers to send email addresses in the Duo request.\r\n\r\nThis diff adds a new parameter for `pam_duo` called `user_map_file`, which should be a path to a file mapping from system usernames to duo usernames. This gets turned into a dinky little linked list which we walk. If we don't find a mapping in that file, we just send the regular unix username to Duo.\r\n\r\nCCing @aegarbutt because I talked with him about this."},"comment":{"url":"https://api.github.com/repos/duosecurity/duo_unix/issues/comments/78059897","html_url":"https://github.com/duosecurity/duo_unix/pull/62#issuecomment-78059897","issue_url":"https://api.github.com/repos/duosecurity/duo_unix/issues/62","id":78059897,"user":{"login":"BradleyHiggins","id":6495554,"avatar_url":"https://avatars.githubusercontent.com/u/6495554?v=3","gravatar_id":"","url":"https://api.github.com/users/BradleyHiggins","html_url":"https://github.com/BradleyHiggins","followers_url":"https://api.github.com/users/BradleyHiggins/followers","following_url":"https://api.github.com/users/BradleyHiggins/following{/other_user}","gists_url":"https://api.github.com/users/BradleyHiggins/gists{/gist_id}","starred_url":"https://api.github.com/users/BradleyHiggins/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BradleyHiggins/subscriptions","organizations_url":"https://api.github.com/users/BradleyHiggins/orgs","repos_url":"https://api.github.com/users/BradleyHiggins/repos","events_url":"https://api.github.com/users/BradleyHiggins/events{/privacy}","received_events_url":"https://api.github.com/users/BradleyHiggins/received_events","type":"User","site_admin":false},"created_at":"2015-03-10T14:08:41Z","updated_at":"2015-03-10T14:08:41Z","body":"Thanks for the pull request.  Duo's supported solution for this is to the username normalization feature.  I realize that won't work for you out of the box with your current configuration, but you'll probably have a better time going forward if you harass your IT department into modifying the usernames.\r\n\r\nLuckily, there's a simple 5-step process your IT dept can follow to fix this!\r\n(1) Export the Duo users to CSV\r\n(2) Modify the usernames in the CSV to retain the local username, but remove the @ and domain part of the username (plus other changes to make the CSV importable, like changing the CSV headers as per https://www.duosecurity.com/docs/importing_users)\r\n(3) Import the CSV to add the local usernames to Duo.  (Now each user has 2 Duo accounts, one with the e-mail and one without, both linked to the same second factor devices.)\r\n(4) Turn on username normalization for all integrations that send a user's email as username.  (This will transition all integrations over to using the newly imported usernames.)\r\n(5) Modify the CSV to delete the e-mail usernames from Duo, and import that.  (Now each user as 1 Duo account again, identified by local name only.)\r\n\r\nOr, feel free to keep using your modified duo_unix :)  Unfortunately, I don't think it's appropriate to pull the feature into master.\r\n\r\nThanks for using Duo!"}}