[SSSD] Remote user use-case

Stephen Gallagher sgallagh at redhat.com
Fri Nov 5 20:18:19 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

One of SSSD's intended primary use-cases is that of the laptop user. We
support cached, offline authentications to the local machine so that
when a laptop user picks their machine up from their desk and goes home
with it, they can still log in.

So what about the use-case of a user that never goes into the office?
How can SSSD solve the problem of mailing a laptop to a new employee
working out of a home-office? Specifically, how do we provide this user
(probably a non-technical user) access to their account for the first
time, if they don't have direct physical access to the network to
perform that first authentication?

One approach would be for GDM to provide an interface for a user who was
not authenticated on the local machine to connect to a
NetworkManager-controlled VPN like IPSEC or vpnc. This would require a
lot of coordinating work done in the desktop environment (not to mention
the security concerns of allowing an unauthenticated user access to VPN
settings).

Another approach might be setting up SSSD with a utility to allow us to
set a temporary offline cached password. Essentially, an administrator
could provision the machine ahead of time with one remote user
(pre-caching their identity data, but not their real password). The
machine could then be shipped to the user, and the temporary offline
password would be overridden the first time that the user provides a
valid online password.

Is this something we should consider exploring in SSSD 1.5.0? I think
the implementation of this would be fairly straightforward. All we'd
need to do is write a new tool similar to sss_useradd that would
pre-cache a user from the default domain. If the machine is online, it
should be capable of pulling the standard user identity data from the
identity provider, but if the machine is offline it should be possible
to manually provide this information as well. Then the utility would
hash the temporary password in the sysdb and the machine would be ready
to ship off.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkzUZooACgkQeiVVYja6o6PXJgCePruZSFyxyqNQiDdeiS0Im6gs
QhYAoJZz/2BpAaVi/wxzDgt2sskK6GDc
=8N0l
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list