Safeguard Authentication Services (SAS) 7.0 – vastool status reports FAILURE 608: PAM <switchable-auth><auth> not configured for SAS on fresh installs on RHEL 10.2 (4384137)

Return

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title

Safeguard Authentication Services (SAS) 7.0 – vastool status reports FAILURE 608: PAM not configured for SAS on fresh installs on RHEL 10.2

Description

Symptoms

After a clean install of SAS 7.0 on RHEL 10.2, running vastool status returns a warning result similar to the following:

Host:   <hostname, Red Hat Enterprise Linux 10.2 (Coughlan)>
SAS:    <7.0.0.8900>
Domain: <example.domain>
INFO:    SELinux enabled (Permissive), vasd policy is NOT installed.
FAILURE: 608 Pam <switchable-auth><auth> not configured for SAS.
INFO:    634 pam_access found in pam configuration, this might prevent SAS users from logging in
Result:  <Test(s) reported warnings> (2 seconds)(v0.9.3)

Attempting to enable the feature via authselect also fails:

# authselect select AuthenticationServices with-switchable-auth
[error] Unknown profile feature [with-switchable-auth]
[error] Unable to activate profile [AuthenticationServices] Invalid argument

The condition is not observed on hosts that were upgraded from SAS 6.x to 7.0 — only on fresh 7.0 installations on RHEL 10.2.

Cause
RHEL 10.2 introduced a new authselect feature called with-switchable-auth, which is included in the RHEL default (sssd) profile via a switchable-auth PAM stack file:
```
/usr/share/authselect/default/sssd/switchable-auth
```
The SAS-provided AuthenticationServices vendor profile shipped in SAS 7.0 does not yet contain an equivalent switchable-auth file:
```
/usr/share/authselect/vendor/AuthenticationServices/ ← missing switchable-auth
```
Because the file is not present in the SAS vendor profile, vastool status reports the missing PAM stack as FAILURE 608, and authselect cannot activate the with-switchable-auth feature against the SAS profile.

Upgraded hosts (6.x → 7.0) are not impacted because the pre-existing PAM/authselect layout satisfies the check.
Resolution
Known Issue / Bug Acknowledgement

This behavior has been confirmed as a product defect and is being tracked internally by One Identity R&D:
- Bug ID: 725856
- Status: Under review by R&D / Product Management
A fix is planned to be addressed in a future release of Safeguard Authentication Services. At this time, no ETA is available for the corrected build. This article will be updated once release information is confirmed
Change Request

725856

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Request a KB Article

Safeguard Authentication Services (SAS) 7.0 – vastool status reports FAILURE 608: PAM <switchable-auth><auth> not configured for SAS on fresh installs on RHEL 10.2 (4384137)

Title

Description

Symptoms

Cause

Resolution

Known Issue / Bug Acknowledgement

Change Request

Leave a Comment