[SSSD] sssd + pkcs11

Jan Pazdziora jpazdziora at redhat.com
Mon Sep 14 17:41:13 UTC 2015


On Mon, Sep 14, 2015 at 06:40:14PM +0200, Sumit Bose wrote:
> 
> This sounds similar to the Apache use-case Jan is working on where
> Apache verifies that the certificate is valid and the client knows the
> private key.

Right, we don't really investigate how the client managed to get
the certificate to us and how long ago they presented the PIN -- we
just see the TLS session with the certificate verified by mod_ssl.

> In all cases the application just does not call pam_authenticate() but
> goes to pam_acct_mgmt() immediately after calling pam_start(). This way
> the PAM stack is only used for access control (and maybe session setup
> later on) but the authentication step is skipped.

Right.

> > About the implementation, I don't have a concrete idea, but we will
> > need to provide out-of-band information to pam_sssd on whether a
> > certificate was used. I saw that pam_putenv() and pam_getenv() were
> > there and they look like a good candidate for such data. For example
> > the server could call:
> > pam_putenv("DN=BASE64(DN)")
> > pam_putenv("ISSUER_DN=BASE64(ISSUER-DN)")
> > pam_putenv("KEY_HASH=HEX(SHA256(SubjectPublicKeyInfo field))")
> > 
> > and pam_sssd() check using pam_getenv("DN"), pam_getenv("ISSUER_DN") or
> > simply KEY_HASH, whether the strings match the expected user key. Is
> > that reasonable?
> 
> In the Apache use case mentioned above Apache calls SSSD via DBus to
> resolves the user with the help of the certificate, please have a look
> at
> https://fedorahosted.org/sssd/wiki/DesignDocs/LookupUsersByCertificate
> for details. Would this work for you as well?

Wild idea here -- could we run the pam_start with the certificate
as the login name parameter and pam_sss.so would check that the login
name has newlines in it and starts with the correct PEM armor, so
it would do the (equivalent of)
org.freedesktop.sssd.infopipe.Users.FindByCertificate internally?
We would then need a way to pass the username (login) back via some
PAM env variable to the application.

-- 
Jan Pazdziora | adelton at #ipa*, #brno
Senior Principal Software Engineer, Identity Management Engineering, Red Hat


More information about the sssd-devel mailing list