[SSSD] simple access provider / non-sss users

Dmitri Pal dpal at redhat.com
Fri Nov 16 20:55:42 UTC 2012


On 11/16/2012 02:58 PM, Paul B. Henson wrote:
> In our current RHEL5 deployment, we use pam_listfile to control access
> to our servers. While I was putting together our sss config for RHEL6,
> I initially thought I could use the simple access provider to replace
> it. However, we have both central accounts as well as local service
> accounts on some servers. While we try to avoid scenarios where a
> local service account needs to log in directly, in some cases it is
> unavoidable and as such some of them exist in our pam_listfile
> configuration.
>
> The sss pam provider always returns user unknown for these local users
> in the account module, never getting to the access control. I would
> consider it useful for the simple access provider to be able to
> control access based on the allow/deny lists for users that aren't
> part of any sss domain, without that capability it cannot replace
> pam_listfile. I took a look, and unfortunately making such a change
> seems far from trivial 8-/.
>
> What are thoughts on such functionality? From a design perspective, do
> you prefer that this access control mechanism only function with sss
> domain users? From an abstract perspective, it could easily process
> allow/deny for users that it doesn't know about. Groups, OTOH, would
> be more problematic. I think all of our current pam_listfile
> configuration for local accounts is based on users though.
>
> The other option I considered was adding a second sss domain that
> proxied nss_files such that sss was aware of local users. This seemed
> a bit kludgy, more so than just continuing to use pam_listfile, which
> is what we ended up doing.
>

Would moving such accounts into local sssd provider help?


>
> Thanks...
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel


-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager for IdM portfolio
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/






More information about the sssd-devel mailing list