Thanks Dmitri,
I'm sshing from linux boxes.
> SSH does not support cert authentication but in RHEL there have
> been some patches to support X509 certs though I am not sure
> how exactly it would work.
I had this input also from someone else : if I find
something interesting I will report about it here.
My point is that there may have been some kind
of mecanism for the server on which to log in to
ask for the client to bind the ldap server ( when
pam knows that ldap is to be used ) rather than
presenting the usual "login/passwd" message.
This binding operation may have involved sssd
transactions between the client and the server
( so that sssd could bind directly the ldap server
using information passed by the client, and being
therefore able to certify about the requester identity ).
May be a wrong idea.
I'm afraid this is outside of scope of SSSD. Even when using Kerberos auth, I
believe that SSH does the authentication by itself and contacts SSSD only for
identification and subsequent authorization. X.509 authentication would be
probably the same.
> If you use Kerberos and/or IPA for your Lunix/UNIX environment
you
> can provision a user keytab
At this stage my goal is to properly deploy a rightly operated
ldap service for user authentication and authorization.
sso with kerberos or IPA are things that I consider but... as a
next step really ( and with no targetted deadline ! :-)
I think that your life might be easier is you deployed IPA right away. After
all, that's what IPA is for :-) Also SSH with IPA (Kerberos) might be the
right solution you are looking for.
Thanks
Jan