Source: pam-oauth2-device
Section: admin
Priority: optional
Maintainer: Clay Risser <clayrisser@gmail.com>
Rules-Requires-Root: no
Build-Depends:
 debhelper-compat (= 13),
 libcurl4-openssl-dev,
 libldap-dev,
 libpam0g-dev,
Standards-Version: 4.7.0
Homepage: https://github.com/ICS-MU/pam_oauth2_device
Vcs-Browser: https://git.corp.bitspur.com/basedlinux.com/debian/pam-oauth2-device
Vcs-Git: https://git.corp.bitspur.com/basedlinux.com/debian/pam-oauth2-device.git -b debian/unstable

Package: libpam-oauth2-device
Architecture: any
Depends:
 ${shlibs:Depends},
 ${misc:Depends},
Description: PAM module for the OAuth 2.0 Device Authorization Grant
 pam_oauth2_device authenticates a login against an OpenID Connect identity
 provider with the OAuth 2.0 Device Authorization Grant (RFC 8628): the
 prompt shows a verification URL (optionally as a QR code) that the user
 opens on any signed-in device; the module polls the token endpoint, reads
 the userinfo endpoint and maps the identity claim onto the local account
 through a static users map, a claim equal to the local user name, or an
 LDAP lookup. When that claim equals a missing user name, the module
 creates the account and sets no password. An existing account's password
 is left as it is.
 .
 Based Linux uses it for Keycloak login at the GDM greeter with neither
 LDAP nor Kerberos on the client. The module takes the path of its JSON
 configuration as its only PAM argument; an example configuration is
 installed under /usr/share/doc/libpam-oauth2-device/examples.
