[SSSD] SSSD Crypto Support

Stephen Gallagher sgallagh at redhat.com
Wed Mar 14 12:59:33 UTC 2012


SSSD is designed to have support for multiple cryptography libraries.
Originally we build in support for both Mozilla NSS and libcrypto.
However, over the last several releases, libcrypto support has fallen by
the wayside and there is now a notable feature disparity between
versions of SSSD built against Mozilla NSS and versions built against
libcrypto.

The basic functionality still works (we have support for caching
credentials using a SHA512 algorithm provided by either library), but
some of the more advanced features do not.

For example:
1. Support for obfuscated passwords in the sssd.conf requires Mozilla
NSS(*)
2. Support for centrally-managed SSH public keys requires a BASE64
encode/decode routine and in 1.8.2 wil add a SHA1 hash routine. There is
no equivalent available in libcrypto at this time.

Going forward, the core upstream for SSSD (all of whom run on Fedora and
RHEL systems which have been consolidated on Mozilla NSS for some time)
is planning to formally drop support for libcrypto. However, we're
certainly willing to continue supporting it if someone else is willing
to own the maintenance on it. Thus, I am CCing the maintainers of SSSD
in non-Fedora/RHEL distributions that I know of. If anyone here is
relying on libcrypto support and is willing to take over its
maintenance, please speak up.

(*) I consider this a misfeature imposed upon us by incompetent
auditors, but it's still a checkbox on someone's list.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120314/937c6165/attachment.sig>


More information about the sssd-devel mailing list