Hello,
I have a use case of ssh authentication to some server which for
various reasons (one of them being network isolation) cannot access to
Directory.
With ssh I can use ssh certificates to do the authentication part
"offline" without the need for the server to access any centralized
service.
But I still need LDAP connexion to get directory information (numeric
uid, groups, etc.)
I would like a mechanic which allows to transmit this information
along with the connexion initiation.
For example the ssh certificate could have some extension options like
uid(a)example.com=1234 and groups(a)example.com=wheel,admin,mygroup and
this certificate would create the corresponding entries in SSSD in
passwd and groups databases which would be valid for the duration of
the certificate.
Do anyone knows of such a setup or have any pointer to similar ideas ?
Do you think it would be possible for SSSD to be extended to support
this use case ? Would it be easy to implement ? (a bunch of
AuthorizedKeyCommand shell scripts interacting with SSSD D-Bus
interface would suit me)
François
Show replies by thread