[SSSD] [PATCH] pam_sss: add ignore_unknown_user option

Alexander Bokovoy abokovoy at redhat.com
Wed Feb 12 10:36:14 UTC 2014


On Tue, 11 Feb 2014, Pete Fritchman wrote:
>https://fedorahosted.org/sssd/ticket/2232
>
>FreeBSD's openpam doesn't have a built in way of ignoring an unknown
>user (e.g. treating PAM_USER_UNKNOWN as a pass for a required module,
>like Linux's user_unknown=ignore tag), so there needs to be an
>ignore_unknown_user flag built in to the PAM module. This patch makes
>pam_sss return PAM_IGNORE instead of PAM_USER_UNKNOWN when
>ignore_unknown_user is passed in from the PAM config. FWIW, this is
>how pam_ldap works on FreeBSD with local accounts, too.
>
>This patch allows us to keep pam_sss marked as required for the PAM
>"account" facility (to enforce HBAC rules) but still allow local users
>to log in.
>
>jhrozek suggested posting the patch here for review, so thanks in
>advance for looking it over!
No patch was attached to your email, could you please send it again?
-- 
/ Alexander Bokovoy



More information about the sssd-devel mailing list