On Tue, Jun 30, 2015 at 02:09:31PM +0200, Sumit Bose wrote:
On Tue, Jun 30, 2015 at 01:47:01PM +0200, Jan Pazdziora wrote:
My only concern is that the domain name as returned by sssd is lowercase which does not really match the realm as seen by say mod_auth_kerb or mod_auth_gssapi. But I guess uppercasing the string is up to consumer of that value.
hm, the ticket said domain and not realm and unfortunately there might
Sure, I'm not complaining that it's returning the domain value.
be cases where the upper-case domain name does not match the realm used for authentication.
When I run pam_acct_mgmt with login name having REALM in it and not the (nonmatching) domain / section, will it pass?
How are you planning to use the realm later on in your Apache module?
I'm looking for a way to pass the Web application unique (FQDN) identifier of the user that has authenticated either via Kerberos or via PAM. Because after all it's the same user and the application really does not care how they are named, as long as the naming is stable and identifying the user properly.