On Tue, Jun 30, 2015 at 02:09:31PM +0200, Sumit Bose wrote:
On Tue, Jun 30, 2015 at 01:47:01PM +0200, Jan Pazdziora wrote:
>
> My only concern is that the domain name as returned by sssd is
> lowercase which does not really match the realm as seen by say
> mod_auth_kerb or mod_auth_gssapi. But I guess uppercasing the string
> is up to consumer of that value.
hm, the ticket said domain and not realm and unfortunately there might
Sure, I'm not complaining that it's returning the domain value.
be cases where the upper-case domain name does not match the realm
used
for authentication.
When I run pam_acct_mgmt with login name having REALM in it and not
the (nonmatching) domain / section, will it pass?
How are you planning to use the realm later on in your Apache module?
I'm looking for a way to pass the Web application unique (FQDN)
identifier of the user that has authenticated either via Kerberos or
via PAM. Because after all it's the same user and the application
really does not care how they are named, as long as the naming is
stable and identifying the user properly.
--
Jan Pazdziora
Senior Principal Software Engineer, Identity Management Engineering, Red Hat