[SSSD] should not return "x" for password when there is no shadow information
Simo Sorce
ssorce at redhat.com
Mon Nov 9 15:37:04 UTC 2009
On Mon, 2009-11-09 at 09:41 -0500, Brian J. Murrell wrote:
> On Mon, 2009-11-09 at 08:59 -0500, Simo Sorce wrote:
> >
> > If someone opens a bug for that, yes :-)
>
> Done. https://fedorahosted.org/sssd/ticket/266
>
> > However keep in mind that I don't care much for what pam_unix does in
> > any pam target,
>
> That's fair enough, but you have to respect what other pam modules are
> trying to do and provide the information they want in adherence to the
> rules of the information source. Simply saying "well, in our context,
> what pam_xxxx is doing is stupid" is not playing well within the
> ecosystem in which you are playing.
I'm not saying it is stupid, just that we do not care "too much" :)
> > you can always make it so that an error from pam_unix
> > (using sufficient instead of required) is ignored if pam_sss succeed.
>
> Yes, I could, but then I am fiddling with the framework (which on my
> distro, prescribes that pam_unix's account personality is a required)
> which pam_sss is trying to fit into and having to do that fiddling on
> every machine I touch. The whole point of using a centralized
> authentication and information provider is to minimize the per-host
> fiddling.
I agree, that's why I want to add the option, so that each distribution
can set the best default for their configuration needs.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
More information about the sssd-devel
mailing list