[SSSD] more doc for configuring a proxy?

Sumit Bose sbose at redhat.com
Fri May 21 06:49:43 UTC 2010


On Fri, May 21, 2010 at 03:42:10PM +1000, David O'Brien wrote:
> David O'Brien wrote:
> > I'm trying to elaborate and improve the doc on configuring domains, and 
> > I'm looking for more info on how to use a proxy. I've been looking over 
> > what's in the sssd.conf man page, but unlike ldap and krb5, there is no 
> > man page "sssd-proxy".
> > 
> > The very brief statement in the doc about using a proxy reads roughly 
> > "...[can use] an existing NSS library or customized PAM stack...", but 
> > this is not something I know much about, and wouldn't know how to set 
> > one up. A bit more info and an example would be great. Any volunteers?
> > 
> > Thanks a lot.
> I hate it when that happens... find more info 2 seconds after you hit 
> Send :(
> 
> Let me rephrase:
> I have some basic info on proxy config options (proxy_pam_target and 
> proxy_lib_name).
> "If proxy authentication is required"
>   - when would this be true?

If you want to use sssd (e.g. because of caching) but sssd currently
does not support your authentication method natively.

> 
> "you need to specify your own PAM target."
>   - is it likely that users/sysadmins would write their own PAM target 
> in /etc/pam.d/?
>   - example?

put the following content in /etc/pam.d/sssd_proxy
auth        required    pam_ldap.so
account     required    pam_ldap.so
password    required    pam_ldap.so
session     required    pam_ldap.so

and then you can use proxy_pam_target=sssd_proxy.

bye,
Sumit
> 
> I'm right now attempting to get a handle on how proxy_lib_name works and 
> what options are available apart from nis. I think I need to read more 
> about LDAP, PAM, and *.*
> 
> cheers
> -- 
> 
> David
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel



More information about the sssd-devel mailing list