[SSSD] could SSSD provide better integration with backends that PAM?

Sumit Bose sbose at redhat.com
Thu Feb 6 17:17:15 UTC 2014


On Thu, Feb 06, 2014 at 05:29:01PM +0100, Nikos Mavrogiannopoulos wrote:
> Hello,
>  I'm working on a VPN server that among others it needs to authenticate
> users. Since there are various backends that may store users, and PAM
> provides a module to access them all, I currently use a privileged
> process to perform PAM authentication for the users.
> 
> However, PAM is pretty good for interactive password authentication, but
> it doesn't look like it was designed to handle public keys/certificates
> and its API does not provide a way to obtain any additional information
> for the user (e.g., keys, certificates). Thus my server has to handle
> certificate authentication separately from passwords. However, as I
> understand from the SSSD code it has support for backends that could
> store certificates. So the question is, whether my server could
> benefit, if it uses sss directly instead of PAM? Does sss provide a
> library for authentication? If such usage of sss would be possible do
> you see any additional advantages (or disadvantages)?
> 
> (The scenario that the vpn server would benefit, is the case where a
> user connects using TLS-client authentication, and the server -if it
> could obtain the client's public key from SSS- it would verify the
> client without any need for PKI).

Jakub is currently working on an interface to make extended user
information available via D-BUS. Assuming SSSD knows how to obtain the
clients public key would it help you if you can read it from D-BUS?

bye,
Sumit

> 
> regards,
> Nikos
> 
> 
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel



More information about the sssd-devel mailing list