Keycyte PAM 3.2 · Administrator Guide

Configuring Authentication Sources

Besides local users, Keycyte PAM can authenticate users against directory services and identity providers. The Authentication page configures these sources:

• LDAP Configuration: one or more LDAP or Active Directory domains.
• RADIUS Configuration: an external RADIUS server that Keycyte PAM queries as a client.
• Entra ID Configuration: sign-in with Microsoft Entra ID.

When a user signs in with a password, Keycyte PAM tries the sources in this order: local users, RADIUS, LDAP/Active Directory.

To open the page, select Settings > Authentication.

LDAP Configuration

Each LDAP configuration describes one domain. Keycyte PAM uses it to authenticate domain users, to look up their e-mail address and phone number for MFA, to search users and groups when you authorize them in roles, and as the source of Active Directory discovery.

Adding an LDAP Configuration

To add a domain:

1. On the LDAP Configuration card, click Add. The Ldap Credential dialog opens.

2. Specify the following settings:

   Field	Description
   Ldap Address	Host name or IP address of the domain controller, for example dc01.example.com.
   Ldap Port	389 for LDAP (default), usually 636 for LDAPS.
   Username	Bind account that Keycyte PAM uses to search the directory.
   Password	Password of the bind account. When you edit a saved configuration, leave the field empty to keep the current password.
   DNS Suffix	DNS name of the domain, for example example.com. Users can sign in as user@example.com.
   Base	Base DN for user searches, for example DC=example,DC=com.
   Group Base	Base DN for group searches.
   Login Field	Attribute that holds the sign-in name. Default: sAMAccountName.
   Mail Field	Attribute that holds the e-mail address. Default: mail.
   Phone Field	Attribute that holds the phone number. Default: telephoneNumber.
   SSL	Connects over LDAPS.
   Master	Marks this domain as the default. Users who sign in without a domain suffix are authenticated against the master domain.

3. Click Save.

To check the connection, click the test button in the row of the configuration.

Adding a CA Certificate for LDAPS

When SSL is selected, Keycyte PAM must trust the certificate of the domain controller. You can import the certificate automatically from the server or upload it.

To add a certificate:

1. In the row of the configuration, click the certificate (lock) button. The Certificates dialog opens.
2. Do one of the following:
   • On the Auto Discovery tab, click Discover Certificates. Keycyte PAM connects to the server and lists the certificates in its chain, with subject, issuer and expiry; the certificate to trust is marked Recommended. Click Trust in its row. To check a certificate first, click View PEM.
   • On the Manual Upload tab, enter an Alias, click Import and select the certificate file (.pem, .crt or .cer), then click Upload.
3. Click Close.

RADIUS Configuration

With a RADIUS configuration, Keycyte PAM forwards sign-in requests to an external RADIUS server, for example an existing MFA server.

Click Save to apply the settings.

To test the connection:

1. Click Test. The RADIUS Test dialog opens.
2. Enter a Username and Password and click Test.
3. If the RADIUS server asks for a second factor, enter the MFA Code and click Verify.

The result appears in the dialog.

Entra ID Configuration

With Entra ID, users sign in to Keycyte PAM with their Microsoft account.

Before you begin, register an application in Microsoft Entra ID and add the redirect URI https://<your-keycyte-host>/sso/entra/callback, for example https://pam.example.com/sso/entra/callback. Create a client secret for the application.

Click Test to check the configuration, then Save. To remove the configuration, click the delete button on the card.

When a user signs in with Entra ID for the first time, Keycyte PAM creates an Entra ID user automatically, but only if the user, or one of the user’s groups, is authorized in a server role or a password role. Otherwise the sign-in is refused and recorded in the Access log.