[SSSD] could SSSD provide better integration with backends that PAM?

Nikos Mavrogiannopoulos nmav at redhat.com
Tue Feb 11 12:23:26 UTC 2014


On Mon, 2014-02-10 at 14:22 -0500, Dmitri Pal wrote:

> >> So I'd still be interested whether the extra attributes will contain
> >> some consistent set of attributes across different SSSD installations,
> >> or they would be system-specific.
> > The extra attributes are defined in sssd.conf, which is per-client, so
> > the set would only be consistent if the sssd.conf is consistent across
> > client installations. In your case you'd have to add something like:
> >   [ifp]
> >   user_attributes = +sshPublicKey
> >
> > We simply can't expose all the attributes on the bus, you don't want to
> > expose the cachedPassword for example.
> Nikos?
> How else can you do it?
> We see it this way: your LDAP has some attribute that you want to expose 
> so you tell SSSDs in your deployment to fetch it and expose it. What is 
> wrong with this approach?

Hello,
 My main concern is what happens when SSSD is configured with an
alternative id provider to LDAP. Will SSSD ensure that the additional
attributes have the same names and format, or are these attributes only
available when the backend is LDAP?

regards,
Nikos





More information about the sssd-devel mailing list