[sssd PR#174][opened] One certificate for multiple users
by sumit-bose
URL: https://github.com/SSSD/sssd/pull/174
Author: sumit-bose
Title: #174: One certificate for multiple users
Action: opened
PR body:
"""
This is the first set of patches related to
https://pagure.io/SSSD/sssd/issue/3050 to allow to authenticate as different
users with a single certificate.
Besides the needed changes for cache_req and PAM it include 2 new InfoPipe
methods ListByCertificate and FindByNameAndCertificate to list all accounts
mapped to a certificate and check if a certificates can be used to authenticate
to a given account.
To test e.g. with FreeIPA just add the certificate not only to a single user
but to other users as well.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/174/head:pr174
git checkout pr174
6 years
[RFC] Smartcard authentication with PKINIT and local authentication
by Sumit Bose
Hi,
with the recent addition of PKINIT support there is now a second method
available to Smartcard authentication besides local authentication.
I was about to add some sssd.conf option which can control the fallback
to local authentication if PKINIT fails. Currently there is only a
fallback to local authentication if the backend is offline or if PKINIT
is not available because either the client or the server side do not
support it.
It came to my mind that it might be more flexible to add the fallback
scheme to the certificate matching rules discussed earlier on this list.
With this it would be possible e.g. to require PKINIT for a set of
certificates and allow local authentication to a different set.
Do you think this would make sense or is it sufficient an option in
sssd.conf which covers all certificates?
bye,
Sumit
6 years
Tlog integration and packages
by Nikolai Kondrashov
Hi everyone,
I'd like to continue the discussion of tlog integration, and also present you
the first release of tlog - a development preview, which has the configuration
interface necessary to implement the integration:
https://github.com/spbnick/tlog/releases/tag/v1
You're more than welcome to download RPMs, install, read tlog-rec(8) and
tlog-rec.conf(5), and experiment! Building from the Git tree and the tarball
works as well, if you're so inclined. I'm also attaching those manpages for
convenience.
Here are the integration plans so far, as discussed with Jakub on our
devconf.cz trip meetings and before on the list. Jakub, please correct me or
add details.
* We follow the route similar to that taken by SELinux rule control
implementation [1][2]. I.e. store the configuration in LDAP HBAC rules,
write to files on the client side and then specify them to tlog upon user
login.
However, I'm also rather fond of the idea of specifying the whole
configuration through an environment variable instead of through a file
referenced by an environment variable - it's not big at all, and we'll avoid
the hassle of managing the files.
I implemented support for both in tlog (was easy).
* We'll have to make nss_sss report user's shell as tlog-rec (how?) and
specify the actual shell to tlog-rec via an environment variable, through
pam_sss (with SSS_PAM_ENV_ITEM messages). I.e.:
* Nss_sss would always report tlog-rec as the user's shell.
* During login (e.g. through "login" or "sshd") pam_sss would add a variable
to the user environment, containing, or pointing at, a tlog-rec
configuration (TLOG_REC_CONF_TEXT or TLOG_REC_CONF_FILE). That
configuration would contain the user's actual shell. I can also implement
support for a separate variable just for the shell (TLOG_REC_SHELL?) to
simplify the implementation for the start.
* Tlog-rec would read the system-wide configuration and overlay it with the
one specified in the environment, adding the specific user shell, and then
would spawn it.
Please also see the draft integration design page [3] for reference.
I hope to refine and extend it in the coming weeks to match FreeIPA standards.
Please chime in and suggest, object, discuss!
Also, please report tlog bugs at https://github.com/spbnick/tlog/issues
Thank you!
Nick
[1]: http://www.freeipa.org/page/SELinux_user_mapping
[2]: http://www.freeipa.org/images/b/b9/Freeipa30_SELinuxUserMap.pdf
[3]: http://www.freeipa.org/page/Session_Recording
6 years
[sssd PR#127][opened] ssh: use cache_req
by fidencio
URL: https://github.com/SSSD/sssd/pull/127
Author: pbrezina
Title: #127: ssh: use cache_req
Action: opened
PR body:
"""
This patches makes SSH responder use the cache_req interface.
Since this responder uses that same `cache-domain-cache` lookup logic
for host certificates I implemented `host by name` request in `cache_req`.
In order to achieve this I moved data provider lookup function from `cache_req`
code into plugins.
The first two patches fixes minor issues in the SSH responder and should be
pushed to earlier versions as well. The first patch fix a little issue
introduced probably by overrides and the second patch removes name qualification
since it is already qualified in the sysdb since fqname patches.
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/127/head:pr127
git checkout pr127
6 years