Title: #553: Use p11_child to verify certificates for the ssh responder
This patch set is another step to solve https://pagure.io/SSSD/sssd/issue/3489,
i.e to remove the NSS dependency and allow all Smartcard and certificate
related features to be build with OpenSSL as well.
To have all the code related to certificate verification in one place the
verification code is removed from the ssh responder and the ssh responder will
now call p11_child to verify a certificate before extracting the public key as
ssh key. Another benefit is that the ssh responder is not blocked anymore
during OCSP check since they now run in p11_child and the ssh responder can
process other requests in parallel.
In this context I also added a patch which improves the documentation of the
feature in the sss_ssh_authorizedkeys man page as requested in
Besides adding unit tests for the new calls I added an unit test for the ssh
responder, similar to the ones for the nss and pam responder.
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/553/head:pr553
git checkout pr553
Title: #570: p11_child: add OpenSSL support
On Thu, May 31, 2018 at 02:02:29AM -0700, sumit-bose wrote:
> ah, sorry, I meant /etc/sssd/pki/sssd_auth_ca_db.pem.
thank you, this works, but it looks like the directory is not created in
Makefile.am. It is owned by the specfile, but I think we also want to
create it when installing from the source.
About permissions, I think we can use the same as /etc/sssd.
See the full comment at https://github.com/SSSD/sssd/pull/570#issuecomment-393834474