Re: [SSSD] Design Discussion: Restricting domains per PAM service

2014-09-29 Thread Simo Sorce
On Mon, 29 Sep 2014 15:28:28 +0200 Jan Pazdziora wrote: > On Tue, Sep 23, 2014 at 10:03:36AM -0400, Simo Sorce wrote: > > > > I would defer this to when we have actual requests for it. > > I am not necessarily opposed but it will be confusing. You see a > > list of domains (or even 'none') and t

Re: [SSSD] Design Discussion: Restricting domains per PAM service

2014-09-29 Thread Jan Pazdziora
On Tue, Sep 23, 2014 at 10:03:36AM -0400, Simo Sorce wrote: > > I would defer this to when we have actual requests for it. > I am not necessarily opposed but it will be confusing. You see a list > of domains (or even 'none') and then you have to (at least > mentally) parse all the code snippets to

Re: [SSSD] Design Discussion: Restricting domains per PAM service

2014-09-23 Thread Jakub Hrozek
On Tue, Sep 23, 2014 at 11:01:22AM -0400, Simo Sorce wrote: > > > > Normally, the list of allowed domains for untrusted users should > > > > be 'all', which is the current behavirour. However, if the > > > > trusted user list is set, we should default to 'none' and require > > > > that access to un

Re: [SSSD] Design Discussion: Restricting domains per PAM service

2014-09-23 Thread Simo Sorce
On Tue, 23 Sep 2014 16:54:45 +0200 Jakub Hrozek wrote: > On Tue, Sep 23, 2014 at 10:03:36AM -0400, Simo Sorce wrote: > > On Tue, 23 Sep 2014 15:39:19 +0200 > > Jakub Hrozek wrote: > > > > > On Tue, Sep 23, 2014 at 09:07:06AM -0400, Simo Sorce wrote: > > > > > Simo, does the design page reflect

Re: [SSSD] Design Discussion: Restricting domains per PAM service

2014-09-23 Thread Jakub Hrozek
On Tue, Sep 23, 2014 at 10:03:36AM -0400, Simo Sorce wrote: > On Tue, 23 Sep 2014 15:39:19 +0200 > Jakub Hrozek wrote: > > > On Tue, Sep 23, 2014 at 09:07:06AM -0400, Simo Sorce wrote: > > > > Simo, does the design page reflect the discussion accurately? Can > > > > we start on the implementation

Re: [SSSD] Design Discussion: Restricting domains per PAM service

2014-09-23 Thread Simo Sorce
On Tue, 23 Sep 2014 15:39:19 +0200 Jakub Hrozek wrote: > On Tue, Sep 23, 2014 at 09:07:06AM -0400, Simo Sorce wrote: > > > Simo, does the design page reflect the discussion accurately? Can > > > we start on the implementation? > > > > Yes I made a minor edit to the password change clause, should

Re: [SSSD] Design Discussion: Restricting domains per PAM service

2014-09-23 Thread Jakub Hrozek
On Tue, Sep 23, 2014 at 09:07:06AM -0400, Simo Sorce wrote: > > Simo, does the design page reflect the discussion accurately? Can we > > start on the implementation? > > Yes I made a minor edit to the password change clause, should we add a > test point about it too ? > > Simo. Ah, thank you ver

Re: [SSSD] Design Discussion: Restricting domains per PAM service

2014-09-23 Thread Simo Sorce
On Tue, 23 Sep 2014 11:22:45 +0200 Jakub Hrozek wrote: > On Mon, Sep 22, 2014 at 05:13:32PM +0200, Jakub Hrozek wrote: > > On Mon, Sep 22, 2014 at 03:58:50PM +0200, Jan Pazdziora wrote: > > > On Mon, Sep 22, 2014 at 03:54:09PM +0200, Jakub Hrozek wrote: > > > > > > > > > > > > > > Why eactly do

Re: [SSSD] Design Discussion: Restricting domains per PAM service

2014-09-23 Thread Jakub Hrozek
On Mon, Sep 22, 2014 at 05:13:32PM +0200, Jakub Hrozek wrote: > On Mon, Sep 22, 2014 at 03:58:50PM +0200, Jan Pazdziora wrote: > > On Mon, Sep 22, 2014 at 03:54:09PM +0200, Jakub Hrozek wrote: > > > > > > > > > > > Why eactly does the list of domains need to be protected by the list > > > > of ui

Re: [SSSD] Design Discussion: Restricting domains per PAM service

2014-09-22 Thread Jakub Hrozek
On Mon, Sep 22, 2014 at 03:58:50PM +0200, Jan Pazdziora wrote: > On Mon, Sep 22, 2014 at 03:54:09PM +0200, Jakub Hrozek wrote: > > > > > > > > Why eactly does the list of domains need to be protected by the list > > > of uids? > > > > Apparently the rest of the PAM data can be faked by the clien

Re: [SSSD] Design Discussion: Restricting domains per PAM service

2014-09-22 Thread Jan Pazdziora
On Mon, Sep 22, 2014 at 03:54:09PM +0200, Jakub Hrozek wrote: > > > > > Why eactly does the list of domains need to be protected by the list > > of uids? > > Apparently the rest of the PAM data can be faked by the client. How is that worse than the current situation when the client can pass "u.

Re: [SSSD] Design Discussion: Restricting domains per PAM service

2014-09-22 Thread Jakub Hrozek
On Mon, Sep 22, 2014 at 02:03:51PM +0200, Jan Pazdziora wrote: > On Fri, Sep 19, 2014 at 08:26:48PM +0200, Jakub Hrozek wrote: > > > > === Overview of the solution === > > On the PAM client side, the PAM module should receive a new option that > > specifies the SSSD domains to authenticate against

Re: [SSSD] Design Discussion: Restricting domains per PAM service

2014-09-22 Thread Jan Pazdziora
On Fri, Sep 19, 2014 at 08:26:48PM +0200, Jakub Hrozek wrote: > > === Overview of the solution === > On the PAM client side, the PAM module should receive a new option that > specifies the SSSD domains to authenticate against. However, the SSSD > daemon can't fully trust all PAM services. We can't

[SSSD] Design Discussion: Restricting domains per PAM service

2014-09-19 Thread Jakub Hrozek
Hi, I have prepared a wiki page summarizing the discussion that happened previously on this list: https://lists.fedorahosted.org/pipermail/sssd-devel/2014-July/020867.html Here is the wiki page: https://fedorahosted.org/sssd/wiki/DesignDocs/RestrictDomainsInPAM For your convenience, I copied the