[SSSD] RADIUS provider

Dmitri Pal dpal at redhat.com
Tue Apr 30 14:38:20 UTC 2013


On 04/30/2013 07:43 AM, Jakub Hrozek wrote:
> On Tue, Apr 23, 2013 at 03:44:20PM +0200, Ondra Hujňák wrote:
>> Hi,
>>
>> I added RADIUS client part to rad provider. It communicates with
>> server now and gets response (Access-Accept or Access-Reject).
>>
>> All changes are available in rad branch of my github repository:
>> https://github.com/hujon/sssd.git
>>
>> I used completely new krad library from Kerberos, so it depends
>> on krb5-libs and verto now. Because in f19 updates there is old
>> version with different API you need to install packages from koji:
>>
>> http://koji.fedoraproject.org/koji/buildinfo?buildID=410384
>>
>> However when I get response, callback is correctly called,
>> I call be_req_terminate but the result doesn't reach su, so it
>> just timeouts and denies access every time. 
>> This is a part of my log:
>>
>> [be_pam_handler] (0x0100): Got request with the following data
>> [pam_print_data] (0x0100): command: PAM_AUTHENTICATE
>> [pam_print_data] (0x0100): domain: RAD
>> [pam_print_data] (0x0100): user: test
>> [sssd[be[RAD]]] [pam_print_data] (0x0100): service: su
>> [sssd[be[RAD]]] [pam_print_data] (0x0100): tty: pts/0
>> [sssd[be[RAD]]] [pam_print_data] (0x0100): ruser: ondra
>> [sssd[be[RAD]]] [pam_print_data] (0x0100): rhost:
>> [sssd[be[RAD]]] [pam_print_data] (0x0100): authtok type: 1
>> [sssd[be[RAD]]] [pam_print_data] (0x0100): newauthtok type: 0
>> [sssd[be[RAD]]] [pam_print_data] (0x0100): priv: 0
>> [sssd[be[RAD]]] [pam_print_data] (0x0100): cli_pid: 14218
>> [sssd[be[RAD]]] [rad_auth_send] (0x0400): Sending request
>> [sssd[be[RAD]]] [rad_auth_done] (0x0400): Permission granted for user test.
>> [sssd[be[RAD]]] [rad_auth_done] (0x0400): Callback terminating be_req.
>> [sssd[be[RAD]]] [be_pam_handler_callback] (0x0100): Backend returned: (0, 0, <NULL>) [Success]
>> [sssd[be[RAD]]] [be_pam_handler_callback] (0x0100): Sending result [0][RAD]
>> [sssd[be[RAD]]] [be_pam_handler_callback] (0x0100): Sent result [0][RAD]
>> [sssd[be[RAD]]] [rad_auth_done] (0x0400): Callback freeing req.
>>
>> If you have any idea what's wrong or any other comments about
>> my code I'll be glad to know ;)
>>
>> Ondrej
> According to the log, the backend sent the return code back to the
> sssd_pam frontend. If you put debug_level=10 into the [pam] section, do
> you see anything logged there?
>
> Other comments about the code:
>  * You can use the standard HOST_NAME_MAX instead of HOSTNAME_LEN_MAX
>
>  * Please don't use space after opening "("
>
>  * rad_req_free() should be a talloc destructor. See how we use
>    talloc_set_destructor elsewhere. Then because rad_req is allocated on
>    top of be_req, you won't have to free it explicitly at all, it's
>    going to be freed when be_req goes away.
>
>  * I think there should be a utility function that would reduce code
>    duplication of this block:
>     tmp = string2data(pass);
>     kerr = krad_attrset_add(rad_req->attrs,
>                             krad_attr_name2num("User-Password"),
>                             &tmp);
>     free(tmp.data);
>  
>  * And most importanly: I don't really like libverto requests mixed with
>    tevent requests in the code. At the very least, the libverto
>    krad_client_send request should be wrapped in a tevent request. The
>    main rad_auth.c module would call:
>
>    subreq = sss_rad_auth_send(parameters);
>    if (subreq == NULL) {
>         /* error */
>    }
>    tevent_req_callback(subreq, rad_auth_done, rad_req);
>
>    Then sss_rad_auth_send should do the libverto stuff internally. To be
>    honest, I'm not sure how safe it is to combine libverto and libtevent
>    in a single process, we should check with tevent/libverto experts,
>    maybe it would be safer to move the authentication into a separate
>    process that would use libverto.
>
> Also is there any howto on setting the environment? I admit I have never
> used radius, so I'm really at loss on how to configure it.

I guess you setup a freeradius server following the HOWTOs on its wiki.
The trick is to establish a shared secret.
There are several open source radius test clients. You can try those and
see how they work.

If you have any questions do not hesitate to ask.


> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel


-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager for IdM portfolio
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/






More information about the sssd-devel mailing list