[SSSD] should ad-gpo support additional logon rights?

Yassir Elley yelley at redhat.com
Thu Jul 31 17:58:06 UTC 2014


----- Original Message -----
> On Thu, Jul 03, 2014 at 01:39:38AM -0400, Yassir Elley wrote:
> > 
> > 
> > ----- Original Message -----
> > 4. Should we add the various gdm-* service names as interactive:
> > gdm-autologin, gdm-fingerprint, gdm-launch-environment, gdm-pin,
> > gdm-smartcard
> > 
> > 5. Should we add the screen savers as interactive: gnome-screensaver,
> > kscreensaver
> 
> I think we should check with Ray Strode (halfline on
> IRC) about the and screensaver semantics. For instance in
> https://bugzilla.redhat.com/show_bug.cgi?id=1104756#c16 Ray argued that
> screensaver only 're-authenticates'.
> 
> I tend to agree about the gdm-* services, but again, checking with Ray
> might be a good idea. I think at least in the past, gdm would do some
> funky stuff with non-password authentication, like sending the authtoks
> to several different pam services and checking which ones would let the
> user through..I'm not sure if it's still the case now after the Gnome
> 3.x rewrite.
> 
> What does gdm-launch-environment do?
> 

I chatted with Ray Strode, who said we should provide defaults (of interactive) for gdm-password, gdm-smartcard, and gdm-fingerprint. The pam gnome-screensaver service has apparently been replaced with a gnome-shell lock screen (starting with RHEL 7). Even on RHEL 6, while the pam_acct_mgmt call is made when unlocking the gnome-screensaver, the results are apparently ignored (b/c the user already has a running session; the lock simply hides the gnome-shell display). He didn't think default values were needed for any of the other gdm related services, such as:
* gdm-pin (no longer supported)
* gdm-autologin (password-less login)
* gdm-launch-environment (used to launch system session for gdm user to run login process)
Note that there is no pam service simply named "gdm".

On the other side, there seem to be four pam services related to kdm: kdm, kdm-np, kcheckpass, and kscreensaver. We should definitely include a default for kdm, but we probably don't care about kdm-np (no-password). Does anyone know how kscreensaver differs from kcheckpass (both have identical pam files, which essentially include system-auth for all calls (auth, account, session, password). Perhaps we should add defaults for both kcheckpass and kscreensaver.

Comments?

Regards,
Yassir.



More information about the sssd-devel mailing list