How do you setup pam authentication?

[chcshinimai]

I'm trying to upgrade 9.2 to 9.4 with pam authentication in our Kubernetes clusters. Most of the configurations migrated straight to 9.4 from 9.2. However, pam authentication isn't working.

I copied /etc/passwd, /etc/group, /etc/shadow files to authenticate via PAM.

I'm tyring to run the below command

runmqsc -u user QMNAME

It works fine on 9.2 but with 9.4, I get the following errors.

Starting MQSC for queue manager QMNAME.
AMQ8135E: Not authorized.

No MQSC commands read.

I added the following lines to qm.ini but it still doesn't work.

SecurityPolicy:
   AuthenticationPolicy = USERID
   UserIdAuthentication = PAM

I'm pretty much stuck. Any advise appreciated.

[arthurbarr]

From MQ 9.2.5, the container samples and any pre-built images do not allow OS (Linux/PAM) users at all. See Security constraints on the use of operating system users in containers. If you need to be able to do this, you'll have to build your own MQ image using the .rpm or .deb files, instead of using the no-install image.

[chcshinimai]

@arthurbarr
Thanks for your quick reply. I don't use IBM MQ Operator though and I'm building the image with production build (make build-mqserver), does it still not support?
By reading the page you sent, it doesn't support with the production build either but I wanted to make sure.

[arthurbarr]

All pre-built images from IBM are built from the same code, which doesn't allow OS users. This is a security measure, as OS users in multi-tenant container environments can pose a security risk. You would need to fork the sample if you really needed them. You could look at this line, and replace it with the RPM-based install (the code of the old sample versions is still available, and shouldn't have changed much)