[SSSD] Radius provider

Ondra Hujňák xhujna00 at stud.fit.vutbr.cz
Tue Apr 16 13:03:58 UTC 2013


10. 4. 2013 v 16:01, Dmitri Pal <dpal at redhat.com>:

> On 04/10/2013 08:45 AM, Ondra Hujňák wrote:
>> 10. 4. 2013 v 13:55, Dmitri Pal <dpal at redhat.com>:
>> 
>>> On 04/10/2013 05:40 AM, Jakub Hrozek wrote:
>>>> On Wed, Apr 10, 2013 at 08:35:51AM +0200, Ondra Hujňák wrote:
>>>>> Hi,
>>>>> 
>>>>> I'm about to develop new provider for RADIUS protocol. I just made some stub and wanted to ask you guys to check the coding style.
>>>>> 
>>>>> My work is available at github repo https://github.com/hujon/sssd.git in branch rad. 
>>>>> 
>>>>> So far it's just a really preliminary review which lacks support for RADIUS. I just wanted to know if I'm heading the right way.
>>>>> 
>>>>> Ondrej Hujnak
>>>> Hi Ondra,
>>>> 
>>>> the stub looks OK, I just have a couple of style comments so far
>>>> (below).
>>>> 
>>>> But most importantly, do you have some kind of design document?
>>> And even before that I want to start with requirements.
>>> Can you please specify how you understand the requirements?
>>> It would help us to guide you in the design phase and clarify what needs
>>> to be accomplished.
>>> 
>>> Thanks
>>> Dmitri
>> Well, the provider is meant to communicate with RADIUS server,
>> so basic two requirements are SSSD and RADIUS server. Because
>> there is no way how to obtain users from RADIUS (AFAIK) there
>> have to be some id provider (such as LDAP).
>> 
>> Is that what you meant?
> 
> I think the caveat it that the requirement is to be able to authenticate
> as a RADIUS user and then to be able to optionally map to a single ldap
> or local user. At least that was one of the use cases. I know it is not
> the best practice but it is something that people have been doing in the
> past and they need this functionality still until they can move to some
> alternative solution which is more secure.
> 

I'm not sure if I truly understand you. Could you be a little more specific about
your use case?

> 
>> 
>> About the design document, I am afraid I do not have it right now,
>> but I'll do it and post it here asap.
>> 
>>>> Anything that describes how the provider should behave and what the
>>>> functionality will be like? For instance I don't know which PAM tasks
>>>> are supported by RADIUS so I can't say if all the actions in
>>>> get_rad_ctx() should be supported or not.

Some description is attached to this email.
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: overview.txt
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130416/dd4a8bef/attachment.txt>
-------------- next part --------------

>>>> 
>>>> As per the style:
>>>> * Don't mix tabs and spaces. Follow the coding guidelines on
>>>>  http://www.freeipa.org/page/Coding_Style
>>>> * Put a space after keywords ("if (" not "if(") and no space after
>>>> * opening "(".
>>>> * Using the new SSSDBG_* DEBUG levels is preferred over the old decimal
>>>>  levels
>>>> * Please put a "copyright blob" on top of every new file. You can copy
>>>>  the blobs from other files but please check with your advisor who
>>>>  holds the copyright since you're doing the project as a thesis -- is
>>>>  it you or the university?
>>>> 
>>>> Also we have recently started to use new SSSD-specific error codes in
>>>> favor of errno. You can take a look at commits
>>>> 233a3c6c48972b177e60d6ef4cecfacd3cf31659 or
>>>> dfd71fc92db940b2892cc996911cec03d7b6c52b
>>>> 
>>>> I would strongly prefer if the new provider used the new error codes.
>>>> 
>>>> When this feature is accepted upstream, it would be an experimental
>>>> feature I think. Can you modify the autoconf scripts so that this new
>>>> provider is only built when --enable-all-experimental-features is used?
>>>> Check out commit b2f9e5b7d553172401a340eb4a9c3abda6b5db43 to see how a
>>>> feature can be marked experimental.
>>>> _______________________________________________
>>>> sssd-devel mailing list
>>>> sssd-devel at lists.fedorahosted.org
>>>> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>>> 
>>> -- 
>>> Thank you,
>>> Dmitri Pal
>>> 
>>> Sr. Engineering Manager for IdM portfolio
>>> Red Hat Inc.
>>> 
>>> 
>>> -------------------------------
>>> Looking to carve out IT costs?
>>> www.redhat.com/carveoutcosts/
>>> 
>>> 
>>> 
>>> _______________________________________________
>>> sssd-devel mailing list
>>> sssd-devel at lists.fedorahosted.org
>>> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>> Thank you for the comments,
>> Ondrej Hujnak
>> 
>> _______________________________________________
>> sssd-devel mailing list
>> sssd-devel at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> 
> 
> -- 
> Thank you,
> Dmitri Pal
> 
> Sr. Engineering Manager for IdM portfolio
> Red Hat Inc.
> 
> 
> -------------------------------
> Looking to carve out IT costs?
> www.redhat.com/carveoutcosts/
> 
> 
> 
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel

I tried to fix my style. There are some new commits in my github repo:
https://github.com/hujon/sssd.git branch rad

Ondrej Hujnak



More information about the sssd-devel mailing list