[SSSD] [PATCH] pam_sss: add ignore_unknown_user option

Jakub Hrozek jhrozek at redhat.com
Wed Feb 12 10:41:19 UTC 2014


On Wed, Feb 12, 2014 at 12:36:14PM +0200, Alexander Bokovoy wrote:
> On Tue, 11 Feb 2014, Pete Fritchman wrote:
> >https://fedorahosted.org/sssd/ticket/2232
> >
> >FreeBSD's openpam doesn't have a built in way of ignoring an unknown
> >user (e.g. treating PAM_USER_UNKNOWN as a pass for a required module,
> >like Linux's user_unknown=ignore tag), so there needs to be an
> >ignore_unknown_user flag built in to the PAM module. This patch makes
> >pam_sss return PAM_IGNORE instead of PAM_USER_UNKNOWN when
> >ignore_unknown_user is passed in from the PAM config. FWIW, this is
> >how pam_ldap works on FreeBSD with local accounts, too.
> >
> >This patch allows us to keep pam_sss marked as required for the PAM
> >"account" facility (to enforce HBAC rules) but still allow local users
> >to log in.
> >
> >jhrozek suggested posting the patch here for review, so thanks in
> >advance for looking it over!
> No patch was attached to your email, could you please send it again?

It was attached to the ticket as a diff.

One more thing I forgot to include in my reply was that in general we
prefer the patches as "git format-patch" output with the ticket URL
included in the commit message.

See:
    https://fedorahosted.org/sssd/wiki/DevelTutorials#Submittingapatchupstream



More information about the sssd-devel mailing list