[SSSD] [PATCHES] Implement MIT Kerberos localauth plugin

Alexander Bokovoy abokovoy at redhat.com
Tue Aug 12 12:59:36 UTC 2014


On Tue, 12 Aug 2014, Jakub Hrozek wrote:
>On Tue, Aug 12, 2014 at 03:30:02PM +0300, Alexander Bokovoy wrote:
>> On Mon, 28 Jul 2014, Simo Sorce wrote:
>> >On Tue, 2014-07-22 at 14:55 +0200, Sumit Bose wrote:
>> >>Hi,
>> >>
>> >>these two patches implement the MIT Kerberos localauth plugin for SSSD.
>> >>Since it uses the new plugin style
>> >>(http://k5wiki.kerberos.org/wiki/Projects/Plugin_support_improvements)
>> >>it has to be activated explicitly. A section like
>> >>
>> >>[plugins]
>> >> localauth = {
>> >>  module = sssd:/path/to/plugin/sssd_krb5_localauth_plugin.so
>> >>  enable_only = sssd
>> >> }
>> >>
>> >>Should work. Please note that this example deactivates any other
>> >>mechanism, e.g. .k5login files. See krb5.conf man page of MIT Kerberos
>> >>1.12 how to active the mechanism as well.
>> >>
>> >>One of the main use cases for this plugin is an IPA environment with
>> >>trust to AD. Currently AD user who want to use SSO with IPA client needed
>> >>a .k5login file in their home directory containing their Kerberos
>> >>principal. Alternatively krb5.conf has to be edited but here the names
>> >>user at the login prompt has to follow a fixed format and are case
>> >>sensitive. If the localauth plugin is activated the mapping of Kerberos
>> >>principal and user name is done by SSSD.
>> >>
>> >>While I was testing the plugin with ssh I found that st least the Fedora
>> >>and RHEL versions of the sshd do not rely completely in the Kerberos
>> >>libraries here but do some checks on their own, especially they check
>> >>for the existence of the .k5login file in the default configuration.
>> >>This check can be disabled by setting KerberosUseKuserok to 'no' but
>> >>then sshd does not call krb5_userok() but the more restrictive
>> >>krb5_aname_to_localname() and does case sensitive checks on the related
>> >>names which won't help much in out case. As a result a .k5login file is
>> >>still needed when testing with ssh but it can be empty or contain random
>> >>content. I will investigate why OpenSSH is patched in this way on Fedora
>> >>and RHEL.
>> >
>> >The patches look good to me, quite simple and direct.
>> >It would be nice to avoid the sshd annoying restrictions in RHEL/Fedora
>> >indeed, and possibly elsewhere.
>> >
>> >
>> >Idea: Can we add a distributors.README file where we start listing all
>> >the common issues we find in packages and warn distributors to patches
>> >they may want to adopt in related packages that we asked Fedora/RHEL
>> >maintainers to add/backport ?
>> It is a good idea overall for both SSSD and FreeIPA to carry a list of
>> such dependencies/fixes. We get regularly questions about backports of a
>> newer code and answering them would be better with a structured list.
>
>I don't object to the idea of the list, but as with any such list, how
>do you maintain it and ensure it's not obsolete?
Since it is a historical information, it wouldn't become obsolete.

"In order to have single sign-on for users from FreeIPA trusted AD
domains, one have to set up libkrb5:

  In libkrb5 prior to 1.12:
    auth_to_local rules must be set explicitly on every machine

  In libkrb5 1.12, in Fedora 21, in RHEL 7.x (where .x is specific
  number where we get libkrb5 1.12 merged):
    set up SSSD localauth plugin instead of auth_to_local rules.
"

and so on, the idea is that information doesn't expire because it
reflects old code which is released out wild and not going to change.
-- 
/ Alexander Bokovoy



More information about the sssd-devel mailing list