[SSSD] could SSSD provide better integration with backends that PAM?

Jakub Hrozek jhrozek at redhat.com
Fri Feb 7 10:11:08 UTC 2014


On Fri, Feb 07, 2014 at 03:09:51AM -0500, Nikos Mavrogiannopoulos wrote:
> > On Thu, Feb 06, 2014 at 05:29:01PM +0100, Nikos Mavrogiannopoulos wrote:
> > > (The scenario that the vpn server would benefit, is the case where a
> > > user connects using TLS-client authentication, and the server -if it
> > > could obtain the client's public key from SSS- it would verify the
> > > client without any need for PKI).
> > Jakub is currently working on an interface to make extended user
> > information available via D-BUS. Assuming SSSD knows how to obtain the
> > clients public key would it help you if you can read it from D-BUS?
> 
> So I suppose you propose to perform PAM authentication, and after the user 
> is authenticated, to query sss over D-BUS with the username to get any additional
> information? That seems pretty ok with my use-case (though I'd prefer a C API).
> Is there any information on that interface currently?

Hi Nikos,

the current API design is here:
https://fedorahosted.org/sssd/wiki/DesignDocs/DBusResponder#TheDBusinterfacedesign

And here is how we propose to access additional attributes:
https://fedorahosted.org/sssd/wiki/DesignDocs/DBusResponder#Accesscontrol

Would something like this work for you?



More information about the sssd-devel mailing list