[SSSD] [PATCH] PAM: Add pam environment variable AUTH_DOMAIN to pam reply

Jakub Hrozek jhrozek at redhat.com
Tue Jun 30 12:00:16 UTC 2015


On Tue, Jun 30, 2015 at 01:47:01PM +0200, Jan Pazdziora wrote:
> On Wed, Jun 10, 2015 at 03:36:04PM +0200, Michal Židek wrote:
> > 
> > See the attached patch that adds the AUTH_DOMAIN variable
> > to pam reply.
> > 
> > Ticket:
> > https://fedorahosted.org/sssd/ticket/2476
> > 
> > Thanks,
> > Michal
> >
> > URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20150610/c84359a5/attachment.bin>
> 
> It does the right thing and I'm able to get the value back via
> pam_getenv(pamh, PAM_ENV_AUTH_DOMAIN) in my Apache module.

Thank you very much for helping with the review.

> 
> My only concern is that the domain name as returned by sssd is
> lowercase which does not really match the realm as seen by say
> mod_auth_kerb or mod_auth_gssapi. But I guess uppercasing the string
> is up to consumer of that value.

That really depends on what the expectation is and what is the use-case.
Currently the code seems to return the name of the sssd domain section
the user authenticated with. That is more or less just a label and can
be really anything.

If for the applications realm is also useful, then
    a) the app can query the sssd dbus interface for the matching realm
    for the domain
    b) we can also return the realm, although the expectations should be
    set right in documentation that not all domain types have the realm
    info (LDAP domain for example)



More information about the sssd-devel mailing list