[SSSD] [PATCH] Two enhancements for PAM client

Simo Sorce ssorce at redhat.com
Fri Apr 23 12:38:10 UTC 2010


On Fri, 23 Apr 2010 10:17:23 +0200
Ralf Haferkamp <rhafer at suse.de> wrote:

> Am Donnerstag 22 April 2010 17:03:23 schrieb Sumit Bose:
> > On Thu, Apr 22, 2010 at 04:37:36PM +0200, Ralf Haferkamp wrote:
> > > Am Donnerstag 22 April 2010 12:08:46 schrieb Sumit Bose:
> > > > Hi,
> > > > 
> > > > the two patches attached should fix #446 and #417 respectively.
> > > > 
> > > > For #417 a different solution, where the message is generated by
> > > > SSSD and send to the client, would be possilbe. But I decided
> > > > against it, because with the attached patch it is possilbe to
> > > > support localized messages.
> > > 
> > > Pardon my ignorance, but why can messages generated by the daemon
> > > not be localized? Am I overlooking something?
> > 
> > The messages generated by the daemon can be localized, but I meant
> > the localization with respect to the settings of the client.
> The client is this case is the PAM module. Which is running as root 
> usually (as is sssd). For best localization you'd need to run in the 
> locale of the authenticating user. So there is no advantage in
> generating the strings on the client side (at least for the PAM
> module). It makes some things even harder as the messeage are
> obviously very depened on the backend that is used.

The PAM module runs within the process that launches it.
At login time that is "login" or "gdm", which are the processes that
know what is the locale the machine is supposed to show at login.

But in a scrensaver for example it runs (or can run) as the user, in
any case it is child of a user process that can let it inherit the
locale.

But sssd has no way of knowing what is the locale of the client unless
the client tells it. And then you have to play magic to convert a
message in that specific locale without causing issues in sssd
(remember that the locale is process wise and sssd is a state machine).

> I agree that for other clients (!=PAM) the localization could be
> easier handled on the client side.

Even in the PAM case localization is more easily and safely done in the
client IMO, even when it is run as root.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York



More information about the sssd-devel mailing list