[SSSD] should not return "x" for password when there is no shadow information

Brian J. Murrell brian at interlinx.bc.ca
Mon Nov 9 14:41:19 UTC 2009


On Mon, 2009-11-09 at 08:59 -0500, Simo Sorce wrote: 
> 
> If someone opens a bug for that, yes :-)

Done.  https://fedorahosted.org/sssd/ticket/266

> However keep in mind that I don't care much for what pam_unix does in
> any pam target,

That's fair enough, but you have to respect what other pam modules are
trying to do and provide the information they want in adherence to the
rules of the information source.  Simply saying "well, in our context,
what pam_xxxx is doing is stupid" is not playing well within the
ecosystem in which you are playing.

> you can always make it so that an error from pam_unix
> (using sufficient instead of required) is ignored if pam_sss succeed.

Yes, I could, but then I am fiddling with the framework (which on my
distro, prescribes that pam_unix's account personality is a required)
which pam_sss is trying to fit into and having to do that fiddling on
every machine I touch.  The whole point of using a centralized
authentication and information provider is to minimize the per-host
fiddling.

b.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20091109/b791e347/attachment.sig>


More information about the sssd-devel mailing list