Hi,
this is the initial version of my patch which add Smartcard
authentication to SSSD. I'm still working on a design page which will
explain everything in more details so I will only add a short version
here.
The main job will be done by a new child process called p11_child. Since
the Smartcard support in GDM is based on NSS I used NSS for the first
version of p11_child as well. But since all PKCS#11 (API to talk to
Smartcards) related code is in this child process adding support for
other PKCS#11 frameworks like p11-kit would be straight forward (in fact
I already started on the p11-kit version). Using NSS here means you have
to add the PKCS#11 module for your Smartcards reader to /etc/pki/nssdb
(the NSS DB GDM uses as well) with modutil or pk11install from the
coolkey package.
The PAM configuration so far must not be changed. pam_sss will do a
pre-auth request similar to the OPT case for find a suitable
authentication method for the user. The pam responder then checks is
Smartcard authentication is enabled (pam_cert_auth = True in the [pam]
section of sssd.conf), if the service is a local one and if there if a
valid certificate can be found which is available in the users LDAP
entry as well. If all this checks pass pam_sss will ask the user for a
PIN and then SSSD tries to validate that PIN, public and private keys
all relate to each other. If no Smartcard is found for the user the
standard password prompt is displayed.
With some valuable input form Christian Heimes I think I found a way to
test the Smartcard support even without real hardware but I still have
to work out some of the details. I will add instructions to the design
page and better and more unit tests.
Any comments and suggestions are welcome.
bye,
Sumit
Show replies by date