On Sat, 11 Feb 2017, Alexander Bokovoy wrote:
On la, 11 helmi 2017, Michael Ströder wrote:
> Jenkins' LDAP integration is pretty good and flexible. I made it work with
various LDAP
> servers in customer projects. I did not have do that with FreeIPA yet but I'd be
very
> surprised if it doesn't work.
>
> (Personally I'd avoid going through PAM.)
Any specific reason for not using pam_sss? Remember, with SSSD involved
you get also authentication for trusted users from Active Directory
realms. You don't get that with generic LDAP way. Also, you'd be more
efficient in terms of utilising LDAP connections.
Having come across this old thread whilst setting this up myself, it turns out that one
possible reason would be that Jenkins’ LDAP plugin provides the user’s display name and
email address to Jenkins, whereas its PAM plugin does not.
I’m sure that the PAM plugin could be improved to provide the display name
straightforwardly enough, but providing the email address would presumably require a new
plugin that fetched the additional details over D-Bus.
--
Peter Oliver