On Fri, May 21, 2010 at 03:42:10PM +1000, David O'Brien wrote:
David O'Brien wrote:
> I'm trying to elaborate and improve the doc on configuring domains, and
> I'm looking for more info on how to use a proxy. I've been looking over
> what's in the sssd.conf man page, but unlike ldap and krb5, there is no
> man page "sssd-proxy".
>
> The very brief statement in the doc about using a proxy reads roughly
> "...[can use] an existing NSS library or customized PAM stack...", but
> this is not something I know much about, and wouldn't know how to set
> one up. A bit more info and an example would be great. Any volunteers?
>
> Thanks a lot.
I hate it when that happens... find more info 2 seconds after you hit
Send :(
Let me rephrase:
I have some basic info on proxy config options (proxy_pam_target and
proxy_lib_name).
"If proxy authentication is required"
- when would this be true?
If you want to use sssd (e.g. because of caching) but sssd currently
does not support your authentication method natively.
"you need to specify your own PAM target."
- is it likely that users/sysadmins would write their own PAM target
in /etc/pam.d/?
- example?
put the following content in /etc/pam.d/sssd_proxy
auth required pam_ldap.so
account required pam_ldap.so
password required pam_ldap.so
session required pam_ldap.so
and then you can use proxy_pam_target=sssd_proxy.
bye,
Sumit
I'm right now attempting to get a handle on how proxy_lib_name works and
what options are available apart from nis. I think I need to read more
about LDAP, PAM, and *.*
cheers
--
David
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel