SSSD / sssd

#2232 [freebsd] pam_sss: add ignore_unknown_user option
Closed: Fixed Opened by petef.

Closed: Fixed
Reopen Issue

FreeBSD's openpam doesn't have a built in way of ignoring an unknown user (e.g. treating PAM_USER_UNKNOWN as a pass for a required module, like Linux's user_unknown=ignore tag), so there needs to be an ignore_unknown_user flag built in to the PAM module. This patch makes pam_sss return PAM_IGNORE instead of PAM_USER_UNKNOWN when ignore_unknown_user is passed in from the PAM config. FWIW, this is how pam_ldap works on FreeBSD with local accounts, too.

This patch allows us to keep pam_sss marked as required for the PAM "account" facility (to enforce HBAC rules) but still allow local users to log in.

attachment
pam_sss.c.diff

Thanks a lot for the patch! It looks OK to me, builds fine and the intent looks fine as well. Can you send the patch to sssd-devel so other developers can take a look as well?

Fields changed

milestone: NEEDS_TRIAGE => SSSD 1.11.5
rhbz: => 0

Updated patch (0001-PAM-add-ignore_unknown_user-option.patch)
  • master: d987dba42894aceff106d557b13812092028cc29
  • sssd-1-11: cb7e16f9fbb989d06b6b01e0a21e69a749dffa08

owner: somebody => jhrozek

Fields changed

owner: jhrozek => somebody

Fields changed

resolution: => fixed
status: new => closed

Lukas implemented additional improvement for cases when sssd is not running:

  • master: ffa42f689dded74b0c0b0451bff3516bc4003179

Metadata Update from @petef:
- Issue set to the milestone: SSSD 1.11.5

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/3274

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
None
Normal
enhancement
SSSD
1.11.3
freebsd
0
1
0
0
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.