On Mon, Sep 14, 2015 at 07:41:13PM +0200, Jan Pazdziora wrote:
On Mon, Sep 14, 2015 at 06:40:14PM +0200, Sumit Bose wrote:
>
> This sounds similar to the Apache use-case Jan is working on where
> Apache verifies that the certificate is valid and the client knows the
> private key.
Right, we don't really investigate how the client managed to get
the certificate to us and how long ago they presented the PIN -- we
just see the TLS session with the certificate verified by mod_ssl.
> In all cases the application just does not call pam_authenticate() but
> goes to pam_acct_mgmt() immediately after calling pam_start(). This way
> the PAM stack is only used for access control (and maybe session setup
> later on) but the authentication step is skipped.
Right.
> > About the implementation, I don't have a concrete idea, but we will
> > need to provide out-of-band information to pam_sssd on whether a
> > certificate was used. I saw that pam_putenv() and pam_getenv() were
> > there and they look like a good candidate for such data. For example
> > the server could call:
> > pam_putenv("DN=BASE64(DN)")
> > pam_putenv("ISSUER_DN=BASE64(ISSUER-DN)")
> > pam_putenv("KEY_HASH=HEX(SHA256(SubjectPublicKeyInfo field))")
> >
> > and pam_sssd() check using pam_getenv("DN"),
pam_getenv("ISSUER_DN") or
> > simply KEY_HASH, whether the strings match the expected user key. Is
> > that reasonable?
>
> In the Apache use case mentioned above Apache calls SSSD via DBus to
> resolves the user with the help of the certificate, please have a look
> at
>
https://fedorahosted.org/sssd/wiki/DesignDocs/LookupUsersByCertificate
> for details. Would this work for you as well?
Wild idea here -- could we run the pam_start with the certificate
as the login name parameter and pam_sss.so would check that the login
name has newlines in it and starts with the correct PEM armor, so
it would do the (equivalent of)
org.freedesktop.sssd.infopipe.Users.FindByCertificate internally?
We would then need a way to pass the username (login) back via some
PAM env variable to the application.
Of course you can put the certificate as a login name to pam_start() but
I think this won't help much because the application has to call one of
the public PAM calls like pam_authenticate(), pam_setcred(),
pam_acct_mgmt(), ... to make libpam pass the value to pam_sss. I think
we would misuse the PAM inferface here.
What might be better is to put the certificate as the user name to
getpwnam() and let the SSSD NSS responder do the lookup. However I would
prefer to do it via InfoPipe because other NSS modules might not be
happy to see such user name.
bye,
Sumit
--
Jan Pazdziora | adelton at #ipa*, #brno
Senior Principal Software Engineer, Identity Management Engineering, Red Hat