[SSSD] [PATCH] PAM: Add pam environment variable AUTH_DOMAIN to pam reply

Sumit Bose sbose at redhat.com
Tue Jun 30 12:09:31 UTC 2015


On Tue, Jun 30, 2015 at 01:47:01PM +0200, Jan Pazdziora wrote:
> On Wed, Jun 10, 2015 at 03:36:04PM +0200, Michal Židek wrote:
> > 
> > See the attached patch that adds the AUTH_DOMAIN variable
> > to pam reply.
> > 
> > Ticket:
> > https://fedorahosted.org/sssd/ticket/2476
> > 
> > Thanks,
> > Michal
> >
> > URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20150610/c84359a5/attachment.bin>
> 
> It does the right thing and I'm able to get the value back via
> pam_getenv(pamh, PAM_ENV_AUTH_DOMAIN) in my Apache module.
> 
> My only concern is that the domain name as returned by sssd is
> lowercase which does not really match the realm as seen by say
> mod_auth_kerb or mod_auth_gssapi. But I guess uppercasing the string
> is up to consumer of that value.

hm, the ticket said domain and not realm and unfortunately there might
be cases where the upper-case domain name does not match the realm used
for authentication.

How are you planning to use the realm later on in your Apache module?

bye,
Sumit 

> 
> -- 
> Jan Pazdziora | adelton at #ipa*, #brno
> Senior Principal Software Engineer, Identity Management Engineering, Red Hat
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel



More information about the sssd-devel mailing list