Hello,
I have a use case of ssh authentication to some server which for various reasons (one of them being network isolation) cannot access to Directory.
With ssh I can use ssh certificates to do the authentication part "offline" without the need for the server to access any centralized service.
But I still need LDAP connexion to get directory information (numeric uid, groups, etc.)
I would like a mechanic which allows to transmit this information along with the connexion initiation.
For example the ssh certificate could have some extension options like uid@example.com=1234 and groups@example.com=wheel,admin,mygroup and this certificate would create the corresponding entries in SSSD in passwd and groups databases which would be valid for the duration of the certificate.
Do anyone knows of such a setup or have any pointer to similar ideas ?
Do you think it would be possible for SSSD to be extended to support this use case ? Would it be easy to implement ? (a bunch of AuthorizedKeyCommand shell scripts interacting with SSSD D-Bus interface would suit me)
François
sssd-users@lists.fedorahosted.org