[SSSD] [PATCH] PAM: Add pam environment variable AUTH_DOMAIN to pam reply

Jakub Hrozek jhrozek at redhat.com
Tue Sep 1 09:00:26 UTC 2015


On Thu, Jul 09, 2015 at 12:35:51PM +0200, Sumit Bose wrote:
> On Thu, Jul 09, 2015 at 11:50:06AM +0200, Jan Pazdziora wrote:
> > On Thu, Jul 09, 2015 at 11:33:11AM +0200, Sumit Bose wrote:
> > > 
> > > Most probable because admin at EXAMPLE.TEST is the Kerberos principal of
> > > your user. If SSSD cannot find a matching user name and the name
> > > contains an '@' it tries to find a Kerberos principal which matches the
> > > full given name.
> > 
> > But realms are case sensitive, aren't they? So while it should work
> > for admin at EXAMPLE.TEST, it should not for admin at example.test.
> 
> you are absolutely correct, not only realms but the whole principal is
> case-sensitive. But we want to play nice with AD users and make it easy
> to log in with the alternative domain suffix feature (some call it log
> in with email address because they often look the same) which is often
> used in larger forests.
> 
> Since AD treats the names and principals case-in-sensitive most AD user
> will not know the correct spelling and so we treat them
> case-in-sensitive in SSSD as well.
> 
> bye,
> Sumit

Restarting stalled thread..

Shall we push this patch to master since it looks correct code wise and
doesn't look like it should regress anything or shall we wait for more
complete solution in 1.14 that would also address domain-vs-realm
concerns?


More information about the sssd-devel mailing list