[SSSD] Design Discussion: Restricting domains per PAM service

Jakub Hrozek jhrozek at redhat.com
Tue Sep 23 13:39:19 UTC 2014


On Tue, Sep 23, 2014 at 09:07:06AM -0400, Simo Sorce wrote:
> > Simo, does the design page reflect the discussion accurately? Can we
> > start on the implementation?
> 
> Yes I made a minor edit to the password change clause, should we add a
> test point about it too ?
> 
> Simo.

Ah, thank you very much, that much clearer. Yes, I agree we should add a
test case -- so far I added one that says pretty much what you said in the
implementation phase. I'm not sure if we need more, because normally you're
not allowed to chpass as anyone else than self and IIRC we explicitly drop
password change requests from root.

In another conversation with Dmitri, I proposed two other changes I'd
like to discuss:

Normally, the list of allowed domains for untrusted users should be
'all', which is the current behavirour. However, if the trusted user
list is set, we should default to 'none' and require that access to
untrusted domains is set explicitly.

The other change is a new [domain] section option, maybe "allow_untrusted"
that would make it possible to augment the global list of domains allowed
for untrusted users. While the option doesn't have too much use now,
it will be very useful when we allow merging configs and defining a new
domain just by dropping a file.



More information about the sssd-devel mailing list