{"comment":{"url":"https://api.github.com/repos/jupyter/jupyterhub/comments/14479639","html_url":"https://github.com/jupyter/jupyterhub/commit/6f2aefb9905eac7e272bf729bf47e165025a5386#commitcomment-14479639","id":14479639,"user":{"login":"dsoares","id":673736,"avatar_url":"https://avatars.githubusercontent.com/u/673736?v=3","gravatar_id":"","url":"https://api.github.com/users/dsoares","html_url":"https://github.com/dsoares","followers_url":"https://api.github.com/users/dsoares/followers","following_url":"https://api.github.com/users/dsoares/following{/other_user}","gists_url":"https://api.github.com/users/dsoares/gists{/gist_id}","starred_url":"https://api.github.com/users/dsoares/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dsoares/subscriptions","organizations_url":"https://api.github.com/users/dsoares/orgs","repos_url":"https://api.github.com/users/dsoares/repos","events_url":"https://api.github.com/users/dsoares/events{/privacy}","received_events_url":"https://api.github.com/users/dsoares/received_events","type":"User","site_admin":false},"position":null,"line":null,"path":"","commit_id":"6f2aefb9905eac7e272bf729bf47e165025a5386","created_at":"2015-11-18T18:34:51Z","updated_at":"2015-11-18T18:34:51Z","body":"This comment is just a NOTE/issue on this: there may be PAM modules to which this code will not work. \r\nFor example, the [pam-mount](http://pam-mount.sourceforge.net/) does not work well with the `pamela` library (also did not work with the previous `simplepam`, i had to write my own wrapper).\r\n\r\nI'm not quite sure about the problem source:\r\n\r\n- When you call `PAM_OPEN_SESSION`, after having used `PAM_END` in `pamela.authenticate`, `pam_mount` can not use the state information stored in the previous `auth` facility (using [`pam_set_item`](http://linux.die.net/man/3/pam_set_item)), since `PAM_END` destroyed all the information stored;  OR \r\n- it's just because `PAM_AUTHENTICATE` and `PAM_OPEN_SESSION` are called separately and don't share the same `handle`, so `PAM_OPEN_SESSION` doesn't have the info it needs.\r\n\r\nAs a result, when it gets to the PAM `session` facility, `pam_mount` does not have the required credencials to mount the user home and it fails - or asks for a password interactively if using option `enable_interactive` (and of course, fails).\r\n\r\nI did not open a PR (here or `simplepam` or `pamela`) because I do not have a nice solution to this. I'm not a PAM expert. For now, i have my own Python wrapper for PAM, cloned from `pamela` (previously cloned from `simplepam`), which simply calls `PAM_OPEN_SESSION` right after `PAM_AUTHENTICATE` (and also have my own Jupyterhub authentication class that deals with `pre_spawn_start` / `post_spawn_stop` and other stuff)."}}