ssh to a device failing

[BeryJu]

Discussed in goauthentik/authentik#21941

^{Originally posted by ammaratef45 April 28, 2026}
Hello, I'm following this documentation to try and ssh into hosts using libpam-authentik and libnss-authentik

After few hours of debugging (included confirming my pam setup, using getent to verify the host knows about the users, re-reading the documentation few times) I finally found the issue (or an issue at least haha)

libpam-authentik[839317]: failed to init interactive auth: code: 'The service is currently unavailable', message: "Interactive authentication not available"

I couldn't wrap my head around this, all I could guess is that ak-agent is the service in questions, I noticed something interesting. when checking the service status without sudo (systemctl status --user ak-agent.service) I see the service running and doing well (no errors).
Add sudo to that same command and this error shows: Failed to connect to bus: No medium found

Help debugging this would be greatly appreciated <3

cc @ammaratef45

[samip5]

Ran into this as well... aka not able to login despite getent finding the user and same error in logs but I have no clues as to why it's not available..

[samip5]

SSH authentication is documented and marketed as an Open Source feature (see features overview table), but the agent currently blocks interactive auth for any unlicensed instance.

What happens

When attempting SSH login on a community/unlicensed instance, the PAM module logs:

libpam-authentik[839317]: failed to init interactive auth: code: 'The service is currently unavailable', message: "Interactive authentication not available"

Root cause

The agent's InteractiveAuth gRPC handler (pkg/agent_system/auth/interactive.go:22) calls ping.InteractiveSupported() before doing anything, and that function (pkg/agent_system/ping/caps.go:12) returns false when LicenseStatus is unset or UNLICENSED — causing an immediate codes.Unavailable error back to the PAM module.

There is no code path that allows interactive SSH auth to proceed without a valid Enterprise license, regardless of the feature's documented tier.

Expected behavior

SSH authentication should work on unlicensed/community instances as documented.

Suggested fix

The license guard in InteractiveSupported() should either be removed, or SSH interactive auth should bypass it and only gate Enterprise-specific capabilities (e.g. fleet connector, local device login) behind the license check.