[SSSD] sssd + pkcs11
Sumit Bose
sbose at redhat.com
Mon Sep 14 09:46:25 UTC 2015
On Mon, Sep 14, 2015 at 11:25:39AM +0200, Nikos Mavrogiannopoulos wrote:
> Hello,
> I've been writing some text to integrate freeipa/sssd with openconnect
> server [0], and for single password or OTP that seems to integrate
> seamlessly. However, when PAM-SSSD is configured to use smart cards,
> that only works with locally inserted cards. That is even if one uses
> the smart card to establish the channel used for VPN, the PAM module
> wouldn't know that. Would it make sense to use a flag (e.g., via
> pam_putenv()) and the caller of the PAM functions set the information
> provided by the certificate used for the session for SSSD to assume a
> card is present? (*)
Hi Nikos,
I'm not sure I can follow, can you described with a bit more details how
it should work?
bye,
Sumit
>
> regards,
> Nikos
>
> [0].
> https://github.com/openconnect/recipes/blob/master/ocserv-freeipa.md
>
> (*). Unfortunately with TLS you can verify a signature from a smart
> card but you cannot have a proof that you did it recently.
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
More information about the sssd-devel
mailing list