[SSSD] [DESIGN] Lookup Users by Certificate

Sumit Bose sbose at redhat.com
Wed May 13 12:57:12 UTC 2015


On Wed, May 13, 2015 at 01:29:49PM +0200, Pavel Březina wrote:
> On 05/13/2015 12:06 PM, Sumit Bose wrote:
> >==== !InfoPipe ====
> >A new method GetUSerAttrByCert() must be implemented which expected the PEM encoded certificate and an array of attrbute names. '''Question: Should we only support PEM here or other formats as well? In this case we need a third parameter indicating the encoding of the certificate data.'''. InfoPipe will convert the certificate into DER encoding with base64 ascii armor, search the cache and eventually forward the request to the backend. The request to the backend is processed similar to a request by name, only that a new filter name, e.g. DP_CERT_ID "cert", is needed.
> >
> >Since it is in general not obvious to which domain a certificate belongs, the search must iterate over all domains in case no matching certificate was found. For the cases where there is a strong 1:1 relationship between the issuer of a certificate and a domain, configuration options for this can be added later.
> 
> Hi,
> the D-Bus method should return object path of the user and it is supposed to
> be under Users interface (patches are on review):
> object_path org.freedesktop.sssd.infopipe.Users.FindByCertificate(cert)

Thank you for the details. I will change the page accordingly and do the
InfoPipe patches on top of the latest version of your patches on the
list (or the committed ones :-).

bye,
Sumit

> 
> GetUserAttr is deprecated from the moment my patches land in master and we
> should no longer introduce similar methods.
> 
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel



More information about the sssd-devel mailing list