On ti, 29 maalis 2022, Roger Seguin via FreeIPA-users wrote:
We have a GUI-based computer program that drives an external
device/machine.
By default our software only displays limited information on that external device.
However, when a power user (group defined in /etc) identifies himself
by entering their credentials through our software GUI, our software
then checks those credentials against /etc/shadow using crypt() and
getspnam() and, if succesful, provides extra functions for configuring
our external device/machine.
Actually, our software runs on several networked computers and our
users, which are all local (defined in /etc), are duplicated on each
computer. This is not ideal and we would rather like to have all users
managed by IPA in a central place (dedicated computer as the IPA
server) with our software running in IPA clients. Therefore, our
software won't be able to check users' credentials using the local
/etc/shadow file anymore.
Basically, we would need to be able to query IPA programmatically (C
language - or at least a shell script) to check that a
username+password is correct.
An ideal method would be to enroll these systems to IPA and use SSSD
through PAM interface. The reason for this is due to the fact that there
are numerous methods of authentication in IPA and if you'd start using
them, you'd had to implement different ways in you application depending
on what method the user has been associated with. This is especially
important for users utilizing two-factor authentication, whether native
IPA one or a RADIUS-based, both of which are available in IPA
environment through Kerberos but not LDAP interfaces. And in Kerberos
they require a particular sequence of steps to initiate the process.
SSSD knows how to cover all these methods and is already exposing it
over PAM interface for normal POSIX applications.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland