[SSSD] could SSSD provide better integration with backends that PAM?

Nikos Mavrogiannopoulos nmav at redhat.com
Thu Feb 6 16:29:01 UTC 2014


Hello,
 I'm working on a VPN server that among others it needs to authenticate
users. Since there are various backends that may store users, and PAM
provides a module to access them all, I currently use a privileged
process to perform PAM authentication for the users.

However, PAM is pretty good for interactive password authentication, but
it doesn't look like it was designed to handle public keys/certificates
and its API does not provide a way to obtain any additional information
for the user (e.g., keys, certificates). Thus my server has to handle
certificate authentication separately from passwords. However, as I
understand from the SSSD code it has support for backends that could
store certificates. So the question is, whether my server could
benefit, if it uses sss directly instead of PAM? Does sss provide a
library for authentication? If such usage of sss would be possible do
you see any additional advantages (or disadvantages)?

(The scenario that the vpn server would benefit, is the case where a
user connects using TLS-client authentication, and the server -if it
could obtain the client's public key from SSS- it would verify the
client without any need for PKI).

regards,
Nikos





More information about the sssd-devel mailing list