URL: https://github.com/SSSD/sssd/pull/5367 Author: pbrezina Title: #5367: pam: add pam_sss_gss module for gssapi authentication Action: opened
PR body: """ The module configuration and usage should be clear from its manual page. Suggestions are welcome.
The main use case is to enable password-less authentication for sudo where smartcards are not possible (because the reader is not available in the target host).
It is not possible to set the service name or keytab at this moment so the module relies on `host/hostname@REALM` where hostname is provided by SSSD (based on the user's domain) and REALM is determined by GSSAPI. This principal is already stored in krb5_keytab location for IPA and AD providers so the functionality is for free.
Because authorization is done by pam_sss and it is not needed for the use case, I would implement configurable ticket names and keytab location only when required by users. """
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5367/head:pr5367 git checkout pr5367
URL: https://github.com/SSSD/sssd/pull/5367 Author: pbrezina Title: #5367: pam: add pam_sss_gss module for gssapi authentication Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5367/head:pr5367 git checkout pr5367
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
Label: +Waiting for review
URL: https://github.com/SSSD/sssd/pull/5367 Author: pbrezina Title: #5367: pam: add pam_sss_gss module for gssapi authentication Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5367/head:pr5367 git checkout pr5367
URL: https://github.com/SSSD/sssd/pull/5367 Author: pbrezina Title: #5367: pam: add pam_sss_gss module for gssapi authentication Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5367/head:pr5367 git checkout pr5367
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
frozencemetery commented: """ (I plan to review this once CI passes.) """
See the full comment at https://github.com/SSSD/sssd/pull/5367#issuecomment-709594169
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
pbrezina commented: """ Thank you. Tests pass, rhel7 and rhel8 failures are not related (infrastructure issues). """
See the full comment at https://github.com/SSSD/sssd/pull/5367#issuecomment-709911505
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
frozencemetery commented: """ I have started review though this is large and will take a bit.
Though on that subject: this is a fairly sizable change, and I don't see anything in the way of tests for it. Have I missed something? """
See the full comment at https://github.com/SSSD/sssd/pull/5367#issuecomment-713076483
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
pbrezina commented: """
Though on that subject: this is a fairly sizable change, and I don't see anything in the way of tests for it. Have I missed something?
We don't currently have framework that would allow to test this. But this is going to change soon so tests will be added later, possibly by QA.
"""
See the full comment at https://github.com/SSSD/sssd/pull/5367#issuecomment-717188633
URL: https://github.com/SSSD/sssd/pull/5367 Author: pbrezina Title: #5367: pam: add pam_sss_gss module for gssapi authentication Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5367/head:pr5367 git checkout pr5367
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
pbrezina commented: """ Pathes were updated. """
See the full comment at https://github.com/SSSD/sssd/pull/5367#issuecomment-717188997
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
pbrezina commented: """ Github hide lots of "conversations" from me so there are many unsolved issues so the patches are not yet ready to be reviewed again. """
See the full comment at https://github.com/SSSD/sssd/pull/5367#issuecomment-717396528
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
frozencemetery commented: """
the patches are not yet ready to be reviewed again.
Okay, just ping me when you want another review and I'll take a look. """
See the full comment at https://github.com/SSSD/sssd/pull/5367#issuecomment-718179110
URL: https://github.com/SSSD/sssd/pull/5367 Author: pbrezina Title: #5367: pam: add pam_sss_gss module for gssapi authentication Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5367/head:pr5367 git checkout pr5367
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
pbrezina commented: """ It's ready for next round. The remaining question is about the proper flag for gssapi otherwise I answered or resolved everything. The issues were mostly cosmetic since we seem to have different coding habits, but since it does not break SSSD's coding style I respected your suggestions. """
See the full comment at https://github.com/SSSD/sssd/pull/5367#issuecomment-718712322
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
sumit-bose commented: """ Hi,
while testing this PR it looks like `KRB5CCNAME` is not respected. If there user uses a different ccache type as defined in `/etc/krb5.conf` or if with `default_ccache_name = FILE:/tmp/krb5cc_%{uid}_XXXXXX` the ccache name has a random component authentication does not work.
If this is currently and expected limitation it should be documented in the man page..
bye, Sumit """
See the full comment at https://github.com/SSSD/sssd/pull/5367#issuecomment-733685105
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
pbrezina commented: """
while testing this PR it looks like `KRB5CCNAME` is not respected. If there user uses a different ccache type as defined in `/etc/krb5.conf` or if with `default_ccache_name = FILE:/tmp/krb5cc_%{uid}_XXXXXX` the ccache name has a random component authentication does not work.
Hmm, nice catch. Unfortunately sudo resets the environment before PAM invocation so KRB5CCNAME is not available for the PAM module. It can be made available by adding it to env_keep in /etc/sudoers but this will also make it available in the called process and this is probably not what we want so we will have to patch sudo to keep this variable for PAM. I'll ask sudo upstream what are our options.
However, even if the variable is available, gssapi uses the default location: pam_sss_gss: Initializing GSSAPI authentication with SSSD pam_sss_gss: Switching euid from 0 to 91600000 pam_sss_gss: Trying to establish security context pam_sss_gss: User domain: ipa.vm, Target name: host@master.client.vm pam_sss_gss: Unable to establish GSS context [maj:0xd0000, min:0x96c73a8d] pam_sss_gss: GSSAPI: Unspecified GSS failure. Minor code may provide more information pam_sss_gss: GSSAPI: No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_91600000_XXXXXX) pam_sss_gss: Switching euid from 91600000 to 0 pam_sss_gss: KRB5CCNAME=FILE:/tmp/krb5cc_91600000_nSfT3j pam_sss_gss: System error [5]: Input/output error
@frozencemetery Is there any gssapi call I should call to make it use this variable?
"""
See the full comment at https://github.com/SSSD/sssd/pull/5367#issuecomment-734305838
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
abbra commented: """ You can pass `ccache` in client creds store you pass to `gss_acquire_cred_from()`. You are already using `keytab` there, passing `ccache` will make use of the ccache. """
See the full comment at https://github.com/SSSD/sssd/pull/5367#issuecomment-734328099
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
sumit-bose commented: """
while testing this PR it looks like `KRB5CCNAME` is not respected. If there user uses a different ccache type as defined in `/etc/krb5.conf` or if with `default_ccache_name = FILE:/tmp/krb5cc_%{uid}_XXXXXX` the ccache name has a random component authentication does not work.
Hmm, nice catch. Unfortunately sudo resets the environment before PAM invocation so KRB5CCNAME is not available for the PAM module. It can be made available by adding it to env_keep in /etc/sudoers but this will also make it available in the called process and this is probably not what we want so we will have to patch sudo to keep this variable for PAM. I'll ask sudo upstream what are our options.
Hi,
this is during authentication and at this stage the enviroment is not cleaned up.
If I use `default_ccache_name = FILE:/tmp/krb5cc_%{uid}_XXXXXX` the module fails and `sudo` will ask for a password, if I check the enviromnet at this stage I see:
# cat /proc/$(pidof sudo)/environ |tr '\0' '\n' | grep KRB KRB5CCNAME=FILE:/tmp/krb5cc_1367201104_K74YJ1
so I guess `$KRB5CCNAME` is available.
HTH
bye, Sumit
"""
See the full comment at https://github.com/SSSD/sssd/pull/5367#issuecomment-734371711
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
pbrezina commented: """ No, if I put getenv directly in the module it is empty unless it is whitelisted in env_keep. """
See the full comment at https://github.com/SSSD/sssd/pull/5367#issuecomment-734783300
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
sumit-bose commented: """
No, if I put getenv directly in the module it is empty unless it is whitelisted in env_keep.
Ok, thanks, good to know that /proc/PID/environ might not contain the current state.
Nevertheless I think it would be good to try getenv() first and use the ccache from the environment if set and only fall back to the default otherwise.
bye, Sumit """
See the full comment at https://github.com/SSSD/sssd/pull/5367#issuecomment-734797577
URL: https://github.com/SSSD/sssd/pull/5367 Author: pbrezina Title: #5367: pam: add pam_sss_gss module for gssapi authentication Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5367/head:pr5367 git checkout pr5367
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
pbrezina commented: """ KRB5CCNAME is now respected, if it is set in env_keep in sudoers (or ldap rules). And I [asked](https://www.sudo.ws/pipermail/sudo-workers/2020-November/001307.html) sudo-workers to see if we can make it available to PAM only. I also updated the manpage. """
See the full comment at https://github.com/SSSD/sssd/pull/5367#issuecomment-735755551
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
sumit-bose commented: """
KRB5CCNAME is now respected, if it is set in env_keep in sudoers (or ldap rules). And I [asked](https://www.sudo.ws/pipermail/sudo-workers/2020-November/001307.html) sudo-workers to see if we can make it available to PAM only. I also updated the manpage.
Thanks,
it is working fine now. I would suggest to mention `env_keep` details in the `pam_sss_gss` man page since `sudo` is the main use-case here.
While testing I came across a behavior which can be a bug or a feature and we should decide how to handle and/or document it.
Currently authentication will be successful if you have a TGT in the credential cache which can be used to successfully request a host ticket. This TGT does not have to be associated with the user calling `sudo`. libkrbr5 provides `krb5_aname_to_localname` to translate the Kerberos principal to a local user name, SSSD provides the localauth plugin for this but inside of SSSD we can just do a `CACHE_REQ_USER_BY_UPN` to check if the principal relates to the user trying to authenticate.
A related item are ccache types which can handle multiple TGTs. Currently the 'active' TGT is used and if the PAM responder would check if the principal matches the user `pam_sss_gss` should either have a way to select the proper TGT if more than one are available or iterate through the available TGTs (which I guess should be avoided). However, I'm not sure if GSSAPI can do this of if plain libkrb5 calls must be used for this. As an alternative an error message can be shown to the user which can point the user to the `kswitch` utility.
bye, Sumit """
See the full comment at https://github.com/SSSD/sssd/pull/5367#issuecomment-738725029
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
abbra commented: """
While testing I came across a behavior which can be a bug or a feature and we should decide how to handle and/or document it.
Currently authentication will be successful if you have a TGT in the credential cache which can be used to successfully request a host ticket. This TGT does not have to be associated with the user calling `sudo`. libkrbr5 provides `krb5_aname_to_localname` to translate the Kerberos principal to a local user name, SSSD provides the localauth plugin for this but inside of SSSD we can just do a `CACHE_REQ_USER_BY_UPN` to check if the principal relates to the user trying to authenticate.
There are two aspects here. `pam_sss_gss` needs to verify the principal maps properly to a user allowed to authenticate. In ksu it is done with `~/.k5login` or `~/.k5users` in the target's user home directory, e.g. by checking the permission on the target's side. In our case we cannot really do this but all we are verifying here is that TGT in the entry is issued in the name of the user who we are impersonating here, e.g. the same user. So you are right that it should be the same check as SSSD does. It would not allow mapping other principals to the same user in terms of sudo acces (e.g. it would not allow a service principal to impersonate user over sudo). This would be a notable difference to ksu behavior but perhaps we cannot do anything here. Still, it should be documented in my opinion.
A related item are ccache types which can handle multiple TGTs. Currently the 'active' TGT is used and if the PAM responder would check if the principal matches the user `pam_sss_gss` should either have a way to select the proper TGT if more than one are available or iterate through the available TGTs (which I guess should be avoided). However, I'm not sure if GSSAPI can do this of if plain libkrb5 calls must be used for this. As an alternative an error message can be shown to the user which can point the user to the `kswitch` utility.
GSSAPI implementation in MIT Kerberos treats ccache collections as a whole and attempts to pick up the TGT or a service ticket from the ccache closest to the target service realm. It means you don't need to perform anything on GSSAPI level to pick up a TGT from the ccache with the target realm but if that one exists, a different ccache will not be considered, unlike raw Kerberos case where you have to manually choose the active ccache.
"""
See the full comment at https://github.com/SSSD/sssd/pull/5367#issuecomment-738753037
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
sumit-bose commented: """
A related item are ccache types which can handle multiple TGTs. Currently the 'active' TGT is used and if the PAM responder would check if the principal matches the user `pam_sss_gss` should either have a way to select the proper TGT if more than one are available or iterate through the available TGTs (which I guess should be avoided). However, I'm not sure if GSSAPI can do this of if plain libkrb5 calls must be used for this. As an alternative an error message can be shown to the user which can point the user to the `kswitch` utility.
GSSAPI implementation in MIT Kerberos treats ccache collections as a whole and attempts to pick up the TGT or a service ticket from the ccache closest to the target service realm. It means you don't need to perform anything on GSSAPI level to pick up a TGT from the ccache with the target realm but if that one exists, a different ccache will not be considered, unlike raw Kerberos case where you have to manually choose the active ccache.
But you can have multiple TGTs for different principals of the target service realm, e.g. user@AD.DOMAIN and Adminstrator@AD.DOMAIN. In this case I think GSSAPI prefers the one which is currently active, so you have to choose manually here as well.
bye, Sumit
"""
See the full comment at https://github.com/SSSD/sssd/pull/5367#issuecomment-738757799
URL: https://github.com/SSSD/sssd/pull/5367 Author: pbrezina Title: #5367: pam: add pam_sss_gss module for gssapi authentication Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5367/head:pr5367 git checkout pr5367
URL: https://github.com/SSSD/sssd/pull/5367 Author: pbrezina Title: #5367: pam: add pam_sss_gss module for gssapi authentication Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5367/head:pr5367 git checkout pr5367
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
pbrezina commented: """ We can read user's UPN and send it to the PAM module, then request credentials for this principal in `gss_acquire_cred_from`. This should resolve both concerns. Please, see updated patch - it also automatically inherits pam_gssapi_services in subdomains, contains some changes to the manpage and adds pam_syslog call for errors. """
See the full comment at https://github.com/SSSD/sssd/pull/5367#issuecomment-739955381
URL: https://github.com/SSSD/sssd/pull/5367 Author: pbrezina Title: #5367: pam: add pam_sss_gss module for gssapi authentication Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5367/head:pr5367 git checkout pr5367
URL: https://github.com/SSSD/sssd/pull/5367 Author: pbrezina Title: #5367: pam: add pam_sss_gss module for gssapi authentication Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5367/head:pr5367 git checkout pr5367
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
pbrezina commented: """ Please, see new changes.
1. Only canonical UPN is returned and it is used only as a hint - if we fail to obtain credentials for the principal we try again and let GSSAPI to choose. This allows user to login with both canonical UPN and basic UPN. (Note: I did not find a way how to test the return code via some macro.) 2. cache_req_user_by_upn is called after gssapi handshake is done and it checks for username == found user 3. added new option pam_gssapi_check_upn (defaults to true) that can turn 2. on and off 4. pam_gssapi_services defaults to "-" meaning disabled to overcome the fact that we can't tell whether the option is set and empty or unset 5. I updated man page to describe these changes
"""
See the full comment at https://github.com/SSSD/sssd/pull/5367#issuecomment-742811517
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
sumit-bose commented: """ Hi,
thanks for the updates, all my tests are working well. There is a missing `</para>` in the pam_sss_gss man page.
I like the idea using `-` to unset an option, we might want to use this with other options in future as well. But I would suggest to mention in the man page entry explicitly that the hyphen/minus character can be used to unset the option.
bye, Sumit """
See the full comment at https://github.com/SSSD/sssd/pull/5367#issuecomment-743137297
URL: https://github.com/SSSD/sssd/pull/5367 Author: pbrezina Title: #5367: pam: add pam_sss_gss module for gssapi authentication Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5367/head:pr5367 git checkout pr5367
URL: https://github.com/SSSD/sssd/pull/5367 Author: pbrezina Title: #5367: pam: add pam_sss_gss module for gssapi authentication Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5367/head:pr5367 git checkout pr5367
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
pbrezina commented: """ Thank you. Here's a diff:
```diff diff --git a/src/man/pam_sss_gss.8.xml b/src/man/pam_sss_gss.8.xml index d4bb705e3..ce5b11bff 100644 --- a/src/man/pam_sss_gss.8.xml +++ b/src/man/pam_sss_gss.8.xml @@ -46,6 +46,7 @@ already present in the Kerberos credentials cache or if user's ticket granting ticket can be used to get the correct service ticket then the user will be authenticated. + </para> <para> If <option>pam_gssapi_check_upn</option> is True (default) then SSSD requires that the credentials used to obtain the service tickets can @@ -183,9 +184,18 @@ auth sufficient pam_sss_gss.so <option>[domain_realm]</option> in /etc/krb5.conf like so: </para> <para> - 2. Authentication does not work and syslog contains "Can't find - client principal $NAME in cache collection": Try to kinit with the - required principal name. + 3. Authentication does not work and syslog contains "No Kerberos + credentials available": You don't have any credentials that can be + used to obtain the required service ticket. Use kinit or autheticate + over SSSD to acquire those credentials. + </para> + <para> + 4. Authentication does not work and SSSD sssd-pam log contains "User + with UPN [$UPN] was not found." or "UPN [$UPN] does not match target + user [$username].": You are using credentials that can not be mapped + to the user that is being authenticated. Try to use kswitch to + select different principal, make sure you authenticated with SSSD or + consider disabling <option>pam_gssapi_check_upn</option>. </para> <programlisting> [domain_realm] diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml index 69cd4c3a1..d637e2eaa 100644 --- a/src/man/sssd.conf.5.xml +++ b/src/man/sssd.conf.5.xml @@ -1712,8 +1712,11 @@ p11_uri = library-description=OpenSC%20smartcard%20framework;slot-id=2 <para> Comma separated list of PAM services that are allowed to try GSSAPI authentication using - pam_sss_gss.so module. This option can be also set - in domain section. + pam_sss_gss.so module. + </para> + <para> + To disable GSSAPI authentication, set this option + to <quote>-</quote> (dash). </para> <para> Note: This option can also be set per-domain which
``` """
See the full comment at https://github.com/SSSD/sssd/pull/5367#issuecomment-743188615
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
sumit-bose commented: """ Hi,
thanks for your patience, ACK. I will set the label when the CI checks are done.
bye, Sumit """
See the full comment at https://github.com/SSSD/sssd/pull/5367#issuecomment-743214829
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
Gundersanne commented: """ Hai,
So cockpit's perspective to this patch as I understand it:
Cockpit would build an s4u ccache using gssapi. This means that the ccache we'd use has the target user as the client principal (so not the cockpit principal building the cache). As far as I understand that means calling `krb5_aname_to_localname` in that context would yield the target principal, not the cockpit principal who built the cache.
That said we would not have a TGT for that user, the way s4u works means we'd just have tickets for specific services, in this case the sudo service. But I think that should be fine, as in a "normal" scenario you'd just use that TGT to get a ticket for the sudo service.
Having this option on by default where that client principal needs to match a local user makes sense to me, as I think that's the scenario cockpit would fall under. Cockpit would ssh into a machine with a host ticket, and then escalate using the sudo service ticket, only for that specific user. So I think this should be fine, and gets an ACK from our side :)
"""
See the full comment at https://github.com/SSSD/sssd/pull/5367#issuecomment-743232917
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
sumit-bose commented: """ The rawhide failure is expected and the rhel8 failure is due to an issue in the CI runner. """
See the full comment at https://github.com/SSSD/sssd/pull/5367#issuecomment-743275053
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
Label: -Waiting for review
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
Label: +Accepted
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
Label: +Ready to push
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
Label: -Ready to push
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
Label: +Ready to push
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
sumit-bose commented: """ Pushed PR: https://github.com/SSSD/sssd/pull/5367
* `master` * d09aa174b04a825979f31c61b05239de088a732f - pam: add pam_sss_gss module for gssapi authentication * fffe3169bb490c4b010b168c639aa6f9b2ec0c52 - pam: add pam_gssapi_check_upn option * d63172f1277c5ed166a22f04d144bf85ded4757c - pam: add pam_gssapi_services option * dcc42015f7ada1c4e4daed17e2c8087e29cb7616 - pam: fix typo in debug message * a3e2677f919c6b1b1649ad80cc3435b4bb2efc0d - cache_req: add helper to call user by upn search * 6715b31f2e12c7f76cfb477551cee46e697c7d51 - domain: store hostname and keytab path * 3b0e48c33c6b43688ff46fed576266cfe6362595 - packet: add sss_packet_set_body * 45f2eb57dc9068cba13099cab90f1be3f3455442 - sss_format.h: include config.h
"""
See the full comment at https://github.com/SSSD/sssd/pull/5367#issuecomment-746410857
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
Label: +Pushed
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
Label: -Accepted
URL: https://github.com/SSSD/sssd/pull/5367 Title: #5367: pam: add pam_sss_gss module for gssapi authentication
Label: -Ready to push
URL: https://github.com/SSSD/sssd/pull/5367 Author: pbrezina Title: #5367: pam: add pam_sss_gss module for gssapi authentication Action: closed
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5367/head:pr5367 git checkout pr5367
sssd-devel@lists.fedorahosted.org