[SSSD] [PATCHES] Add support for Smartcard authentication

Roland Mainz rmainz at redhat.com
Mon Jul 27 12:54:29 UTC 2015



----- Original Message -----
> From: "Roland Mainz" <rmainz at redhat.com>
> To: "Development of the System Security Services Daemon" <sssd-devel at lists.fedorahosted.org>
> Cc: "Kai Engert" <kengert at redhat.com>
> Sent: Tuesday, 21 July, 2015 3:08:44 AM
> Subject: Re: [SSSD] [PATCHES] Add support for Smartcard authentication
> 
> 
> 
> ----- Original Message -----
> > From: "Sumit Bose" <sbose at redhat.com>
> > To: sssd-devel at lists.fedorahosted.org
> > Sent: Friday, 17 July, 2015 9:01:49 PM
> > Subject: Re: [SSSD] [PATCHES] Add support for Smartcard authentication
> > 
> > On Fri, Jul 10, 2015 at 06:40:30PM +0200, Sumit Bose wrote:
> > > Hi,
> > > 
> > > this is the initial version of my patch which add Smartcard
> > > authentication to SSSD. I'm still working on a design page which will
> > > explain everything in more details so I will only add a short version
> > > here.
> > > 
> > > The main job will be done by a new child process called p11_child. Since
> > > the Smartcard support in GDM is based on NSS I used NSS for the first
> > > version of p11_child as well. But since all PKCS#11 (API to talk to
> > > Smartcards) related code is in this child process adding support for
> > > other PKCS#11 frameworks like p11-kit would be straight forward (in fact
> > > I already started on the p11-kit version). Using NSS here means you have
> > > to add the PKCS#11 module for your Smartcards reader to /etc/pki/nssdb
> > > (the NSS DB GDM uses as well) with modutil or pk11install from the
> > > coolkey package.
> > > 
> > > The PAM configuration so far must not be changed. pam_sss will do a
> > > pre-auth request similar to the OPT case for find a suitable
> > > authentication method for the user. The pam responder then checks is
> > > Smartcard authentication is enabled (pam_cert_auth = True in the [pam]
> > > section of sssd.conf), if the service is a local one and if there if a
> > > valid certificate can be found which is available in the users LDAP
> > > entry as well. If all this checks pass pam_sss will ask the user for a
> > > PIN and then SSSD tries to validate that PIN, public and private keys
> > > all relate to each other. If no Smartcard is found for the user the
> > > standard password prompt is displayed.
> > > 
> > > With some valuable input form Christian Heimes I think I found a way to
> > > test the Smartcard support even without real hardware but I still have
> > > to work out some of the details. I will add instructions to the design
> > > page and better and more unit tests.
> > > 
> > > Any comments and suggestions are welcome.
> > 
> > Please find attached an improved version of the patches.
> 
> One quick nit in b/src/responder/pam/pamsrv.h:
> -- snip --
>      int public_domains_count;
> +
> +    bool cert_auth;
> +    int p11_child_debug_fd;
> -- snip --
> Typically |int| is 32bit and |bool| is one byte, so we end-up with a 3byte
> pad here for no good reason. Better would be this order:
> -- snip --
> -- snip --
>      int public_domains_count;
> +
> +    int p11_child_debug_fd;
> +    bool cert_auth;
> -- snip --
> (same applies to |struct pam_check_cert_state| with 64bit pointers vs. |int|)
> 
> Question:
> In src/p11_child/p11_child_nss.c |PK11_SetPasswordFunc(password_passthrough)|
> uses memory from |PL_strdup()| - who is freeing that memory (|PL_free()|) ?
> 
> > Especially
> > there are improvements to the test, the return values from the p11_child
> > are not mocked used the actual retrieved certificate data. The test data
> > causes some increase in the patch size. I plan to replace this with data
> > which is generate during the test run but for a start it is easier this
> > way.
> > 
> > I also added a 7th patch which should resolve
> > https://fedorahosted.org/sssd/ticket/2711 (SSH with certificates).
> > Strictly it is not related to Smartcard authentication via PAM but it
> > depends on the NSS version of the cert utilities (patch 0001) so I
> > included it here as well.
> > 
> > On the design page I added the 'How to test' section
> > https://fedorahosted.org/sssd/wiki/DesignDocs/SmartcardAuthenticationStep1#Howtotest
> > which hopefully gives sufficient details how to set up a test
> > environment.
> 
> Is there any development branch I can use to checkout and build these changes
> in one step ? It'll make testing of future versions a tick easier...

Development branch for checkout is available at https://fedorapeople.org/cgit/sbose/public_git/sssd.git/log/?h=smartcard ...

----

Bye,
Roland

-- 
  __ .  . __
 (o.\ \/ /.o) rmainz at redhat.com
  \__\/\/__/  IPA/Kerberos5 team
  /O /==\ O\  
 (;O/ \/ \O;)
 



More information about the sssd-devel mailing list