On Thu, Jan 9, 2020 at 7:59 AM Lars Francke <lars.francke(a)gmail.com> wrote:
> > auth: Validates credentials for an object
>
> The auth provider is the backend that sssd uses to provide PAM
> “auth” module services for applications that are configured to
> call pam_sss.so in the PAM auth stack. E.g.:
>
> auth required pam_sss.so
>
> There may be other instances where sssd is called upon to provide
> authentication services, but I’m not coming up with any off the
> top of my head. (The PAM auth stack is the most common case.)
Okay, and I assume that this sometimes relies on the id_provider for
some information.
For the common case of using Kerberos for authentication and LDAP for
identity, no. Unless you are performing PKINIT, all you need in order
to perform Kerberos authentication is the principal to authenticate
and the KDC servers to contact. You don’t need any information from
LDAP.
> > One very specific question for example: What does the krb5
auth
> > mean? Does it retrieve a ticket and try to decrypt that?
>
> Setting “auth_provider = krb5” means that sssd will attempt
> Kerberos authentication if sssd is called upon to authenticate a
> user, such as when pam_sss.so is called in the PAM auth stack for
> an application.
Yeah, but this I don’t understand.
Kerberos authentication is a pretty broad description.
Not really. Kerberos authentication means Kerberos authentication.
There are multiple RFCs for it, starting with RFC1510 (now obsolete).
Does it just fetch a TGT?
No; it performs an AS-REQ and decrypts the enc-part of the AS-REP in
order to extract the session key and TGT.
This might help:
http://www.securityandit.com/network/kerberos-protocol-understanding/
Because if Preauthentication is disabled in Kerberos then anyone can
request one so that can’t be sufficient. It also needs to try and
decrypt it.
That’s what the protocol requires, yes.
Does it store it in the local ticket cache etc…
I looked at the man pages but there are no details to be found :(
The sssd-krb5(5) man page describes the (many) options sssd has
related to Kerberos credential caching, credential refreshing,
et. al. E.g.:
krb5_ccname_template (string)
krb5_lifetime (string)
krb5_renew_interval (string)
krb5_store_password_if_offline (boolean)
Is that documentation not sufficient to answer your questions?