Features/SSSDByDefault

From FedoraProject

< Features(Difference between revisions)
Jump to: navigation, search
(Update status)
Line 15: Line 15:
 
* Targeted release: [[Releases/13 | Fedora 13 ]]  
 
* Targeted release: [[Releases/13 | Fedora 13 ]]  
 
* Last updated: 2009-12-02 15:00:00 EST
 
* Last updated: 2009-12-02 15:00:00 EST
* Percentage of completion: 10%
+
* Percentage of completion: 70%
 +
 
 +
=== 2009-12-11 ===
 +
* The SSSD's SSSDConfig python API is complete
 +
* authconfig-6.0.0-1, currently built in Koji and awaiting a Rawhide compose, contains all of the GUI features necessary for configuring the SSSD, taking advantage of the SSSDConfig python API
 +
 
 +
Still to do:
 +
* Integrate support with firstboot
 +
* Add SSSD to the default package set (pending FESCo approval of this Feature)
  
 
== Detailed Description ==
 
== Detailed Description ==

Revision as of 12:30, 11 December 2009

Contents

SSSD By Default

Summary

This feature is a proposal to include SSSD by default in the set of base Fedora 13 packages, and to have it be configurable, through authconfig, by firstboot.

Owner

  • email: sgallagh@redhat.com

Current status

  • Targeted release: Fedora 13
  • Last updated: 2009-12-02 15:00:00 EST
  • Percentage of completion: 70%

2009-12-11

  • The SSSD's SSSDConfig python API is complete
  • authconfig-6.0.0-1, currently built in Koji and awaiting a Rawhide compose, contains all of the GUI features necessary for configuring the SSSD, taking advantage of the SSSDConfig python API

Still to do:

  • Integrate support with firstboot
  • Add SSSD to the default package set (pending FESCo approval of this Feature)

Detailed Description

This feature would provide support in firstboot for joining a client to an LDAP/Kerberos or FreeIPA server. Users would be able to select "Use Network Login" during firstboot setup and configure it for connection to one or more central identity and authentication stores.

Benefit to Fedora

The prime benefit of the System Security Services Daemon is support for offline logins. Above and beyond the traditional pam_ldap or pam_krb5 approaches, the SSSD would remove the need for laptop users of Fedora to maintain a local account, separate from their centrally-managed account, to work offline or disconnected from the central servers.

Scope

The SSSD and its dependency packages (libtdb, libldb, libtevent, libtalloc and c-ares) need to be included in the default installation of Fedora. Support needs to be added to authconfig to provide a simplistic way to configure the SSSD. To that end, a python API is exposed from the SSSD that can be consumed by authconfig. Support for the new authconfig SSSD features needs to be added to firstboot.

How To Test

Testing will require a centralized identity and authentication store. The SSSD natively supports LDAP as an identity store, and either LDAP or Kerberos 5 as an authentication store. The SSSD has been tested successfully against FreeIPA (LDAP+Kerberos) as well as Fedora DS and MIT Kerberos, and limited testing against ActiveDirectory.

To test, one would need to configure the SSSD using authconfig to communicate with a centralized user store. Then they may attempt to log in using SSH or GDM (or KDM, etc.). If this succeeds, they can then attempt to do the same while offline.

If authenticating against a Kerberos server, they should also verify that they received a valid TGT (when performing online authentication).

User Experience

Users with centrally managed accounts will no longer need to maintain second, local user for use when not connected to the central servers.

Dependencies

At this time, no dependencies other than those listed above are known.

Contingency Plan

If it is not completed in time, Fedora can drop this feature with no ill effects and continue to use the existing remote authentication methods.

Documentation

Release Notes

Fedora 13 can now take advantage of the System Security Services Daemon to enable high-performance, cached authentication and identity lookups, as well as support for offline authentication.

Offline caching of identity data is supported for LDAP and FreeIPA servers, and offline authentication is supported for LDAP, Kerberos 5 and FreeIPA authentication servers.

Comments and Discussion