[SSSD] [PATCH] Add ipa_auth

Stephen Gallagher sgallagh at redhat.com
Tue Nov 10 14:18:31 UTC 2009


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/09/2009 05:35 PM, Sumit Bose wrote:
> Hi,
> 
> this patch adds a separate IPA authentication target which glues together
> Kerberos and LDAP authentication to support IPA password migration.
> 
> To test this patch the following two uncommitted patches are needed on
> the server side:
> - "Allow adding entries with pre-hashed passwords, but don't generate
>   keys for them."
> - "Add BIND pre-op for DS->IPA password migration to ipa-pwd-extop DS
>   plugin."
> 
> There is a TODO left, namely to read from the DS if password migration
> in enabled or not. Is there already a place where this information can
> be found?
> 
> bye,
> Sumit
> 

We've talked about this differently in different places, so I'm not sure
there's yet a consensus about how to handle this. On the password
migration wiki, we talk about this being a client-side option, but I
think it makes far more sense for this to be stored in the IPA DS, so
that it can be globally configured for all IPA clients.

I'm adding Rob and Pavel to this list so they can comment on the ease or
difficulty of supporting this on the server-side.

> 
> 
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel


- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkr5djIACgkQeiVVYja6o6MumACeMlwIZjH7qJHESDWfhUeFV8bf
2gwAoJMy6+cQxly1wcFkru/jEcPPtWwd
=IYAY
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list