Hello there

Not sure that this is feasable nor that this is the right place
to submit this question but I think it is.

I use sssd to deal with authentication on my linux boxes :

I also know how to use external SASL_MECH to bind my
ldap server : I have produced and install a certificate with
an appropriate subject and signed it by a CA that is known
by my ldap server. Like this, I can bind the server over TLS
with my identity and without providing any passwd.

$ ldapsearch -ZZ uid=olivier
SASL/EXTERNAL authentication started
SASL username: 0.9.2342.19200300.100.1.1=guillard,ou=staff,dc=example,dc=fr

Right : nothing new.

I was now wondering if there would have any way to annonce
my certificate using the "external SASL_MECH"  mechanism
over a login process to a linux box (let say using ssh), so that
pam would not ask me to type a "login" and a "password" to
log in ?

Don't hesitate to fire if my question is stupid.



PS, to rephrase that : I'm looking for a way to use a personnal key
to login without having to provide a password. ssh keys are not
the right solution because I would need to install the public key
in every authorized_key on my network ( I would like a centralized
solution ).

I also found this :

But I don't want to patch ssh if possible since I highly prefere to
use standard tools provided as much as possible

I'm on RedHat6