On Tue, Jun 30, 2015 at 01:47:01PM +0200, Jan Pazdziora wrote:
On Wed, Jun 10, 2015 at 03:36:04PM +0200, Michal Židek wrote:
See the attached patch that adds the AUTH_DOMAIN variable to pam reply.
Ticket: https://fedorahosted.org/sssd/ticket/2476
Thanks, Michal
URL: https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20150610/c84359a5/attachment.bin
It does the right thing and I'm able to get the value back via pam_getenv(pamh, PAM_ENV_AUTH_DOMAIN) in my Apache module.
Thank you very much for helping with the review.
My only concern is that the domain name as returned by sssd is lowercase which does not really match the realm as seen by say mod_auth_kerb or mod_auth_gssapi. But I guess uppercasing the string is up to consumer of that value.
That really depends on what the expectation is and what is the use-case. Currently the code seems to return the name of the sssd domain section the user authenticated with. That is more or less just a label and can be really anything.
If for the applications realm is also useful, then a) the app can query the sssd dbus interface for the matching realm for the domain b) we can also return the realm, although the expectations should be set right in documentation that not all domain types have the realm info (LDAP domain for example)