[SSSD] pick up "EXTERNAL MECH" identity to log in

Jan Zelený jzeleny at redhat.com
Wed Apr 11 07:36:26 UTC 2012


> Thanks Dmitri,
> 
> I'm sshing from linux boxes.
> 
> > SSH does not support cert authentication but in RHEL there have
> > been some patches to support X509 certs though I am not sure
> > how exactly it would work.
> 
> I had this input also from someone else : if I find
> something interesting I will report about it here.
> 
> My point is that there may have been some kind
> of mecanism for the server on which to log in to
> ask for the client to bind the ldap server ( when
> pam knows that ldap is to be used ) rather than
> presenting the usual "login/passwd" message.
> 
> This binding operation may have involved sssd
> transactions between the client and the server
> ( so that sssd could bind directly the ldap server
> using information passed by the client, and being
> therefore able to certify about the requester identity ).
> 
> May be a wrong idea.

I'm afraid this is outside of scope of SSSD. Even when using Kerberos auth, I 
believe that SSH does the authentication by itself and contacts SSSD only for 
identification and subsequent authorization. X.509 authentication would be 
probably the same.

> > If you use Kerberos and/or IPA for your Lunix/UNIX environment you
> > can provision a user keytab
> 
> At this stage my goal is to properly deploy a rightly operated
> ldap service for user authentication and authorization.
> 
> sso with kerberos or IPA are things that I consider but... as a
> next step really ( and with no targetted deadline !  :-)

I think that your life might be easier is you deployed IPA right away. After 
all, that's what IPA is for :-) Also SSH with IPA (Kerberos) might be the 
right solution you are looking for.

Thanks
Jan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120411/67e16264/attachment.sig>


More information about the sssd-devel mailing list