(airavata-custos) 02/03: Build the PAM module from extensions and deploy the prompt logo art

[la...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

lahirujayathilake pushed a commit to branch pam-logo
in repository https://gitbox.apache.org/repos/asf/airavata-custos.git

commit bf4f84f9ac7dad8c97d7ee4f26452c489424bc63
Author: lahiruj <la...@gmail.com>
AuthorDate: Fri Sep 11 14:39:32 2026 -0400

    Build the PAM module from extensions and deploy the prompt logo art
---
 dev-ops/account-provisioning/enroll-node.yml            | 17 ++++++++++++++---
 dev-ops/account-provisioning/group_vars/all.yml.example | 17 ++++++++++++++---
 .../templates/pam-oauth2-config.json.j2                 |  7 ++++++-
 3 files changed, 34 insertions(+), 7 deletions(-)

diff --git a/dev-ops/account-provisioning/enroll-node.yml b/dev-ops/account-provisioning/enroll-node.yml
index 5a2075645..d0d83663f 100644
--- a/dev-ops/account-provisioning/enroll-node.yml
+++ b/dev-ops/account-provisioning/enroll-node.yml
@@ -188,21 +188,22 @@
         state: present
       tags: [pam]
 
-    - name: "[pam] Clone pam_oauth2_device repository"
+    - name: "[pam] Clone pam_oauth2_device source"
       git:
         repo: "{{ pam_oauth2_device_repo }}"
         dest: "{{ pam_oauth2_device_src_dir }}"
+        version: "{{ pam_oauth2_device_version | default('master') }}"
         force: true
       tags: [pam]
 
     - name: "[pam] Build pam_oauth2_device"
       make:
-        chdir: "{{ pam_oauth2_device_src_dir }}"
+        chdir: "{{ pam_oauth2_device_build_dir }}"
       tags: [pam]
 
     - name: "[pam] Install pam_oauth2_device.so"
       copy:
-        src: "{{ pam_oauth2_device_src_dir }}/pam_oauth2_device.so"
+        src: "{{ pam_oauth2_device_build_dir }}/pam_oauth2_device.so"
         dest: /usr/lib64/security/pam_oauth2_device.so
         remote_src: true
         owner: root
@@ -219,6 +220,16 @@
         mode: "0755"
       tags: [pam]
 
+    - name: "[pam] Copy custom logo art"
+      copy:
+        src: "{{ pam_logo_file_src }}"
+        dest: /etc/pam_oauth2_device/logo.txt
+        owner: root
+        group: root
+        mode: "0644"
+      when: pam_logo_file_src is defined
+      tags: [pam]
+
     - name: "[pam] Template pam_oauth2_device config.json"
       template:
         src: templates/pam-oauth2-config.json.j2
diff --git a/dev-ops/account-provisioning/group_vars/all.yml.example b/dev-ops/account-provisioning/group_vars/all.yml.example
index 9618de85a..3a60e69ab 100644
--- a/dev-ops/account-provisioning/group_vars/all.yml.example
+++ b/dev-ops/account-provisioning/group_vars/all.yml.example
@@ -65,10 +65,14 @@ sssd_domain_name: "xxx"
 # -----------------------------------------------------------------------------
 
 # Git repo to clone for building pam_oauth2_device
-pam_oauth2_device_repo: "https://github.com/cyber-shuttle/pam_oauth2_device.git"
+pam_oauth2_device_repo: "https://github.com/apache/airavata-custos.git"
 
-# Where to clone the source on the target
-pam_oauth2_device_src_dir: "/usr/local/src/pam_oauth2_device"
+# Branch or tag to build from
+pam_oauth2_device_version: "master"
+
+# Where to clone the source on the target, and where the module builds
+pam_oauth2_device_src_dir: "/usr/local/src/pam_oauth2_device/airavata-custos"
+pam_oauth2_device_build_dir: "{{ pam_oauth2_device_src_dir }}/extensions/CILogon-SSH-PAM"
 
 # LDAP settings for pam_oauth2_device user lookup
 # This lets the PAM module verify the SSH username exists in LDAP
@@ -82,6 +86,13 @@ pam_oauth2_ldap_attr: "uid"
 # Enable debug logging in pam_oauth2_device (set false for production)
 pam_oauth2_debug: false
 
+# System name shown in the SSH sign-in prompt (defaults to the inventory hostname)
+# pam_prompt_hostname: "login.cluster.example.org"
+
+# Local text file shown in place of the built-in logo art in the sign-in prompt.
+# Copied to /etc/pam_oauth2_device/logo.txt on the node; leave unset for the default art.
+# pam_logo_file_src: "~/cluster-logo.txt"
+
 # -----------------------------------------------------------------------------
 # Validation
 # -----------------------------------------------------------------------------
diff --git a/dev-ops/account-provisioning/templates/pam-oauth2-config.json.j2 b/dev-ops/account-provisioning/templates/pam-oauth2-config.json.j2
index 8ff3a0dad..14be7337a 100644
--- a/dev-ops/account-provisioning/templates/pam-oauth2-config.json.j2
+++ b/dev-ops/account-provisioning/templates/pam-oauth2-config.json.j2
@@ -41,6 +41,11 @@
     "filter": "{{ pam_oauth2_ldap_filter }}",
     "attr": "{{ pam_oauth2_ldap_attr }}"
   },
-  "qr": { "show": false, "error_correction_level": 1 },
+  "qr": { "error_correction_level": 0 },
+  "prompt": {
+    "hostname": "{{ pam_prompt_hostname | default(inventory_hostname) }}"{% if pam_logo_file_src is defined %},
+    "logo_file": "/etc/pam_oauth2_device/logo.txt"
+{% endif %}
+  },
   "tls": { "ca_bundle": "{{ ldap_tls_cacert }}" }
 }