James, thank you for the prompt and detailed response!
Answers/questions inline.

On Tue, Jan 7, 2020 at 6:39 AM James Ralston <ralston@pobox.com> wrote:
On Mon, Jan 6, 2020 at 10:25 AM Lars Francke <lars.francke@gmail.com> wrote:

> Hi,
>
> I've got a question that seems pretty trivial to me so it feels like
> I'm missing something obvious.
>
> I know that there are different provider types: id, auth, chpass,
> access (and maybe others)
>
> But what I don't quite understand is what they actually do.
> The documentation says:
>
> id -> "The identification provider"
> auth -> "The authentication provider"
> access -> "The access control provider"
> chpass -> "The provider which should handle change password
>            operations for the domain."
>
> (The first three are not very helpful ;-) )
>
> I understand chpass and I can make a guess about the others but I'm
> not sure:
>
> id: Just returns information about some object

With the caveat that I am not an sssd developer and the following
information is from my own understanding only:

The id provider is the backend that sssd uses to provide identity
information.

The most common instance where identity information is required is the
(getpwnam, getpwuid, getgrnam, getgrgid) glibc library functions.
When /etc/nsswitch.conf contains:

    passwd:     sss files systemd
    group:      sss files systemd

…then these glibc library functions will first call sssd to attempt to
look up users/uids/groups/gids.  The mechanism that sssd uses to
perform the resolution is determined by the “id_provider” setting and
the various options that the selected id provider mechanism supports.

As another example, if you are using NFSv4 with RPCSEC_GSS
authentication, and /etc/idmapd.conf contains:

    [Translation]
    Method = sss

…then rpc.idmapd(8) will call sssd in order to translate between NFSv4
symbolic names (what the NFSv4 protocol uses on the wire when
RPCSEC_GSS is in use) and uids/gids.

Makes sense, thank you.
 

> auth: Validates credentials for an object

The auth provider is the backend that sssd uses to provide PAM “auth”
module services for applications that are configured to call
pam_sss.so in the PAM auth stack.  E.g.:

    auth    required        pam_sss.so

There may be other instances where sssd is called upon to provide
authentication services, but I’m not coming up with any off the top of
my head.  (The PAM auth stack is the most common case.)

Okay, and I assume that this sometimes relies on the id_provider for some information.
 
> access: Checks authorization?

The access provider is the backend that sssd uses to provide PAM
“account” module services for applications that are configured to call
pam_sss.so in the PAM account stack.  E.g.:

    account required        pam_sss.so

> But I'm very vague on the details. Is there any more information I
> can refer to?

The sssd man pages, most specifically sssd.conf(5), are good places to
start.

> What are the differences/can anyone point me at an API description
> or some other documentation?

Try:

https://docs.pagure.org/SSSD.sssd/developers/internals.html

…and the pages that are in the navigation column on the left of the
above page.

> One very specific question for example: What does the krb5 auth
> mean?  Does it retrieve a ticket and try to decrypt that?

Setting “auth_provider = krb5” means that sssd will attempt Kerberos
authentication if sssd is called upon to authenticate a user, such as
when pam_sss.so is called in the PAM auth stack for an application.

Yeah, but this I don't understand.
Kerberos authentication is a pretty broad description.
Does it just fetch a TGT? Because if Preauthentication is disabled in Kerberos then anyone can request one so that can't be sufficient. It also needs to try and decrypt it. Does it store it in the local ticket cache etc....

I looked at the man pages but there are no details to be found :(

Cheers,
Lars
 
_______________________________________________
sssd-users mailing list -- sssd-users@lists.fedorahosted.org
To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.org