On Wed, Sep 30, 2020 at 08:54:57PM +0000, Yancho Yanev wrote:
Hello,
We are trying to integrate Azure Active Directory with Linux. We already did NSSWITCH and
PAM prototypes but it looks like SSSD is a much better extension place because of the
caching and offline capabilities.
Unfortunately I cannot find sample code or instructions how to write a SSSD plugin.
Neither I can see a devel package with the interface definitions.
Hi,
thank you for reaching out to us, this sound like a very interesting
project.
I think the best way to understand how to add a new backend is to look
at existing code. It is expected that a new backend is implemented in
the SSSD tree hence there is no devel package for backends.
How do we add a provider? Can we do it in our own repo or the only way is to develop in
yours?
Also, I see that you are "fedorahosted". If this a clone for Fedora only? Does
your enlistment produce Ubuntu packages or is the Ubuntu stuff in a different place?
"fedorahosted" was one of the first hosting platforms we used, but the
current development happens on github
https://github.com/SSSD/sssd which
we use for bug reports and pull request as well. This project is not
Fedora specific the SSSD Ubuntu, Debian, SuSE etc packages are build
from this source as well.
How different is "Azure Archive Directory" from classical "Active
Directory"? Would it make sense to enhance the existing SSSD AD provider
or would it make more sense to create a new one?
At simple example for a backend is
https://github.com/SSSD/sssd/tree/master/src/providers/simple which only
implements an access_provider which corresponds to the functionality you
might have already implemented in pam_sm_acct_mgmt() in you PAM
prototype.
The main parts of backend interface are an init function e.g.
https://github.com/SSSD/sssd/blob/master/src/providers/simple/simple_acce...
with a name like sssm_BACKENDNAME_FUNCTIONTYPE_init. This init function
should call dp_set_methods()
https://github.com/SSSD/sssd/blob/master/src/providers/simple/simple_acce...
to specify the function which should be called to process the request.
For a start you need init functions for user and group lookups
corresponding to what you have in the NSSWITCH prototype (e.g.
https://github.com/SSSD/sssd/blob/master/src/providers/ad/ad_init.c#L520),
for authentication (pam_sm_authenticate) (e.g.
https://github.com/SSSD/sssd/blob/master/src/providers/ad/ad_init.c#L546)
and access control (e.g.
https://github.com/SSSD/sssd/blob/master/src/providers/ad/ad_init.c#L572).
Do you have your prototypes accessible in a public repo? If yes, I'd be
happy to check what would be the most easy start to add this to SSSD.
For a prove of concept you might even consider to use your prototypes
with SSSD's proxy provider which can load existing nss and PAM modules,
see man sssd.conf for details. But this would be only for a very first
start.
Please do not hesitate to ask further questions here or by sending an
email directly to me.
HTH
bye,
Sumit
Thank you,
Yancho Yanev
_______________________________________________
sssd-devel mailing list -- sssd-devel(a)lists.fedorahosted.org
To unsubscribe send an email to sssd-devel-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahoste...