URL:
https://github.com/SSSD/sssd/pull/553
Author: sumit-bose
Title: #553: Use p11_child to verify certificates for the ssh responder
Action: opened
PR body:
"""
This patch set is another step to solve
https://pagure.io/SSSD/sssd/issue/3489,
i.e to remove the NSS dependency and allow all Smartcard and certificate
related features to be build with OpenSSL as well.
To have all the code related to certificate verification in one place the
verification code is removed from the ssh responder and the ssh responder will
now call p11_child to verify a certificate before extracting the public key as
ssh key. Another benefit is that the ssh responder is not blocked anymore
during OCSP check since they now run in p11_child and the ssh responder can
process other requests in parallel.
In this context I also added a patch which improves the documentation of the
feature in the sss_ssh_authorizedkeys man page as requested in
https://pagure.io/SSSD/sssd/issue/3688.
Besides adding unit tests for the new calls I added an unit test for the ssh
responder, similar to the ones for the nss and pam responder.
"""
To pull the PR as Git branch:
git remote add ghsssd
https://github.com/SSSD/sssd
git fetch ghsssd pull/553/head:pr553
git checkout pr553