Hi Dmitri,
On Fri, 2011-07-29 at 12:31 -0400, Dmitri Pal wrote:
On 07/29/2011 11:58 AM, Martyn Taylor wrote:
> Identity
>
> Goals
> - support authentication against external LDAP
> - provide authentication mechanism across aeolus components
>
> Conversation Topics
>
> * LDAP Support:
>
> * Conductor auth against LDAP with local DB Fallback
>
> * conductor first tries authenticate user against external LDAP
> server. If user is found there, user account in local db is created
> (except credentials) if it doesn't exist yet. If user is not found in
> LDAP, local db is searched.
>
I wonder why reinvent the wheel. Can you use local pam stack for
authentication
Using PAM is an interesting idea. It does make the app more complicated
to install and configure, though. And makes it less portable. Also, I
don't see much talk of Rails apps using PAM.
All that being said, though, it might be a good option for LDAP support
assuming we retain the option of using Conductor's DB as an identity
store.
and configure SSSD.
SSD is what would give us the identity cache, right?
The motivation there was for laptop use cases, right? i.e. where you
want to be able to authenticate a user even when you can't reach the
LDAP server?
It already provides all the functionality you are talking about.
* Local storage
i.e. authenticate against /etc/shadow ?
* External LDAP auth
And lots of other auth options
* Identity cache
That's from SSD?
[..]
> * do we need UI for LDAP config (it's probably only IP
+ port,
> maybe LDAP domain), if so we will need some table for saving
> configuration (we don't have this yet)
If you go with SSSD it is not needed. Everything goes to sssd.conf
All LDAP configuration is in sssd.conf? No extra PAM, nsswitch or
OpenLDAP config?
Cheers,
Mark.