SSSD / sssd

#3500 Make sure sssd is a replacement for pam_pkcs11 also for local account authentication
Closed: Fixed Opened by jhrozek.

Closed: Fixed
Reopen Issue

pam_pkcs11 is no longer maintained upstream: https://github.com/OpenSC/pam_pkcs11/blob/master/README.md

And it doesn't even build with the latest OpenSSL. In the meantime, SSSD gained many capabilities to support smart card authentication.

This ticket is more of a task tracker to remind us that we need to test and document the use case of a local user with a smart card. Chances are no code changes are required in SSSD, but there might be changes required to the PAM stack.

Documenthing this would enable other distributions to either reuse our documentation or right away tune their default PAM stack.

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD 2.0

Metadata Update from @jhrozek:
- Issue priority set to: blocker

As pam_pkcs11 is going away and is being replaced by pam_sssd for local smart card authentication, what are your plans for closer specification of PKCS#11 slot/object that will be used to authenticate users?

The pam_pkcs11 had options slot_description and slot_num, which were able to specify restrict the selection in cumbersome way (given that slot numbers is not guaranteed to be stable if I am right).

So far, I see you only specify pam_cert_db_path and the rest of it is handled by NSS. Do you plan to implement a way of clarifying the token/certificate objects, such as PKCS#11 URIs (RFC 7512)?

Metadata Update from @sbose:
- Issue assigned to sbose

Commit d724ea3c relates to this ticket

First two patches are laying the groundwork:
* d724ea3c21de7d29a8910a217efa88e93b329129
* 72099c320a02b5ce1941947a572e210afd849d7c

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD 2.1 (was: SSSD 2.0)

Metadata Update from @jhrozek:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1615417

Issue linked to Bugzilla: Bug 1615417

It would be great to have this! Especially if in sss_user_mod there is a way to add the userCertificate etc. Making the unrollment process painless is super important. I look forward to seeing this!

https://github.com/SSSD/sssd/pull/656

Metadata Update from @sbose:
- Custom field patch adjusted to on
  • master:
    657f3b89bca9adfb13f0867c91f1d76845d2d6dd
    d332c8a0e7a4c7f0b3ee1b2110145a23cbd61c2a
    a45a410dc7fa7cf84bcac541e693ee8781e25431
    91aea762d02731193eb66a00b930ff1fe8bc5ab8
    442ae7b1d0704cdd667d4f1ba4c165ce3f3ffed4
    16941c47a6f0fc2f1679725d55cde221f3c3a6ef
    0c739e969a617bdb4c06cdfd63772bf6d283c518
    d42f44d54453d3ddb54875374c1b61dc1e7cd821
    9fdc5f1d87a133885e6a22810a7eb980c60dcb55
    275eeed24adc31f3df51cf278f509a4be76a3a3c
    9386ef605ffbc03abe2bc273efddbc099441fe3b
    06f7005d38d164879b727708feff80004b422f91
    15301db1dc1e5e2aafc1805a30e3b28756218c9b
    d9cc38008a51a8a5189904f175e4d10cbde4a974
    0bf709ad348ca115443bd21e4e369abd5d7698c4
    d1dd7f7703b4f40d2fbb830e28969b31b8a1673e
    7c619ae08f05a7595d15cf11b64461a7d19cfaa7

Metadata Update from @jhrozek:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @jhrozek:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1615417, https://bugzilla.redhat.com/show_bug.cgi?id=1521083 (was: https://bugzilla.redhat.com/show_bug.cgi?id=1615417)

Issue linked to Bugzilla: Bug 1521083

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4526

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
Lowest
https://bugzilla.redhat.com/show_bug.cgi?id=1615417, https://bugzilla.redhat.com/show_bug.cgi?id=1521083
on
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.