#50: Adding SSSD client bits to Fedora base image -----------------------------+--------------------- Reporter: adelton | Owner: kanarip Type: task | Status: new Priority: major | Milestone: Component: kickstart pool | Keywords: Blocked By: | Blocking: -----------------------------+--------------------- = phenomenon =
Hello,
we are working on SSSD container for Atomic Host: https://lists.projectatomic.io/projectatomic-archives/atomic- devel/2015-September/msg00086.html
It allows SSSD (the daemon) plus the configuration tools (ipa-client- install, realm) to be in container but for other container to be able to use it for resolution of user identities or authentication, NSS and PAM libraries that would be able to talk to the SSSD container via Unix sockets are needed.
= background analysis =
The libraries that I consider essential are
/usr/lib64/libnss_sss.so.2 /usr/lib64/sssd/modules/sssd_krb5_localauth_plugin.so /usr/lib64/security/pam_sss.so
The package that contains them is sssd-client and it has two dependencies, libsss_idmap and libsss_nss_idmap. The total size as reported by dnf in a fedora:22 container is
Total download size: 284 k Installed size: 336 k
= implementation recommendation =
Could these packages be added to Fedora base image? It would make it much easier to deploy images built from the base image with SSSD's Unix socket directory bind-mounted and NSS and PAM would automatically be able to use remote user identities (from FreeIPA, Active Directory, or possibly other backends supported by SSSD), without any explicit changes needed in the layered images.
The SSSD container can also serve as plugin for sudo via /usr/lib64/libsss_sudo.so but dependencies of sssd-common where it is distributed would add 5.6 M when installed and I believe having out-of-box support for remote sudo rules is not that critical -- if the layered image uses sudo, it can add it explicitly.
#50: Adding SSSD client bits to Fedora base image ----------------------------+---------------------- Reporter: adelton | Owner: kanarip Type: task | Status: new Priority: major | Milestone: Component: kickstart pool | Resolution: Keywords: | Blocked By: Blocking: | ----------------------------+----------------------
Comment (by maxamillion):
+1
Applied.
https://git.fedorahosted.org/cgit/spin- kickstarts.git/commit/?id=ee22a9c00c250e6b141094dfadc6a45a1ec7f7b2
#50: Adding SSSD client bits to Fedora base image ----------------------------+-------------------------- Reporter: adelton | Owner: maxamillion Type: task | Status: assigned Priority: major | Milestone: Component: kickstart pool | Resolution: Keywords: | Blocked By: Blocking: | ----------------------------+-------------------------- Changes (by maxamillion):
* owner: kanarip => maxamillion * status: new => assigned
#50: Adding SSSD client bits to Fedora base image ----------------------------+-------------------------- Reporter: adelton | Owner: maxamillion Type: task | Status: closed Priority: major | Milestone: Component: kickstart pool | Resolution: fixed Keywords: | Blocked By: Blocking: | ----------------------------+-------------------------- Changes (by maxamillion):
* status: assigned => closed * resolution: => fixed
#50: Adding SSSD client bits to Fedora base image ----------------------------+-------------------------- Reporter: adelton | Owner: maxamillion Type: task | Status: closed Priority: major | Milestone: Component: kickstart pool | Resolution: fixed Keywords: | Blocked By: Blocking: | ----------------------------+--------------------------
Comment (by adelton):
Replying to [comment:1 maxamillion]:
+1
Applied.
kickstarts.git/commit/?id=ee22a9c00c250e6b141094dfadc6a45a1ec7f7b2
Thanks.
Would you be open to committing to f23, and perhaps also to f22 braches? Should I open separate tickets?
#50: Adding SSSD client bits to Fedora base image ----------------------------+-------------------------- Reporter: adelton | Owner: maxamillion Type: task | Status: closed Priority: major | Milestone: Component: kickstart pool | Resolution: fixed Keywords: | Blocked By: Blocking: | ----------------------------+--------------------------
Comment (by adelton):
Replying to [comment:4 adelton]:
Would you be open to committing to f23, and perhaps also to f22 braches?
Should I open separate tickets?
Per private communication, Fedora 23 will be revisited once the GA dust settles.
-
fedora-badges