[SSSD] [PATCH] PAM: Add domains= option to pam_sss

Daniel Gollub dgollub at brocade.com
Wed Jul 30 14:23:48 UTC 2014


On Wed, 30 Jul 2014 02:17:59 -0700
Jakub Hrozek <jhrozek at redhat.com> wrote:

> On Wed, Jul 30, 2014 at 11:07:01AM +0200, Daniel Gollub wrote:
> > But this would require restart of sssd each time one would add a new
> > (e.g.) VPN endpoint - right?
> 
> Right, is that something you would do regularly, though and not a
> one-off thing when you set up your infrastructure.

In my use-case, using that for a router/vpn appliance this might could
happen more often - but not regularly. E.g. adding new region LDAP for
a VPN or something like that - or dropping VPN access to a specific
VPN concentrate or so. The neat thing would be that one could add an
additional e.g. LDAP or AD server for authentication  - without the
need to worry about temporarily failing authentication of clients while
SSSD is restarting.

Is the enumeration via LDAP/AD is done on every start-up of SSSD? (Even
if this is not recommended on very large LDAP trees - regular
enumeration could be prevent and avoid some noise at somer other end)


> 
> > Right now it is quite convinced that one just can change
> > the /etc/pam.d/* configuration without requiring to restart/reload
> > the PAM-enabled service (e.g. VPN daemon) which authenticates
> > against pam_sss. And also not requiring to restart sssd during
> > business hours or so.
> > 
> > There is no "reload" configuration functionality in sssd yet -
> > right?
> > 
> 
> Correct, we tried and failed, reloading configuration on the fly is
> much harder to implement correctly than it seems.

Yeah, I could imagine that is not trivial to do. So ideal I would like
to avoid to restart sssd every time someone tries to fine-tune the
correct authentication setting for one new VPN endpoint - by
potentially disturbing authentication of "live"/"production" used VPN
endpoints on the system.




More information about the sssd-devel mailing list