[SSSD] more terminology questions

David O'Brien davido at redhat.com
Fri Jun 18 11:51:10 UTC 2010


Sumit Bose wrote:
> On Fri, Jun 18, 2010 at 02:02:34PM +1000, David O'Brien wrote:
>> This time I'm wrestling with "native LDAP" vs any other sort of LDAP, 
>> and where does MS Active Directory fit in?
>>
>> afaik "native LDAP" just means LDAP provides the identities and does the 
>> authentication. If I'm using OpenLDAP or 389 that's easy enough. Switch 
>> to IPA and Kerberos does the auth (= not native LDAP, right?). What if 
>> I'm using MS Active Directory? Does that or can that do both? Does it 
>> provide identities and rely on Kerberos for auth? Should I not be using 
>> "native LDAP" at all to avoid confusion?
>>
>> "native" also comes up in the bug report* in relation to Kerberos:
>> "Should provide an example of using the proxy identity provider in 
>> concert with the native Kerberos authentication." What's "native Kerberos"?
>>
> 
> in gneneral when we are talking about 'native LDAP' or 'native Kerberos'
> we mean the LDAP or Kerberos provider of sssd in contrast to using
> pam_ldap/nss_ldap or pam_krb5 with the proxy_provider.

ok, so it sounds like the following statement in the doc needs some repairs?

"A native LDAP domain is one where the id_provider option is set to ldap 
(id_provider = ldap). Such a domain requires a running LDAP server 
against which to authenticate. This can be an open source LDAP server 
such as OpenLDAP or Microsoft Active Directory. SSSD currently supports 
Microsoft Active Directory 2003 (+Services For UNIX) and Active 
Directory 2008. In all cases, the client configuration is stored in the 
/etc/sssd/sssd.conf file.

SSSD does not support authentication over an unencrypted channel. 
Consequently, if you want to authenticate against an LDAP server, 
TLS/SSL is required. If the LDAP server is used only as an identity 
provider, an encrypted channel is not needed."

In the case where we use pam_ldap/nss_ldap, what would be the value of 
id_provider?

thanks a lot
> 
> HTH
> 
> bye,
> Sumit
> 

-- 

David O'Brien
Senior Technical Writer, Engineering Content Services
Red Hat Asia Pacific Pty Ltd
193 North Quay, Brisbane

"We couldn't care less about comfort. We make you feel good."
Federico Minoli CEO Ducati Motor S.p.A.



More information about the sssd-devel mailing list