New subject: [sssd PR#1001][+Waiting for review] ssh: fix matching rules default

9 Mar 2020


      URL: https://github.com/SSSD/sssd/pull/1001
Author: sumit-bose
 Title: #1001: ssh: fix matching rules default
Action: opened
PR body:
"""
Before the ssh_use_certificate_matching_rules option was added the ssh
responder returned ssh keys derived from all valid certificates. Since
the default of the ssh_use_certificate_matching_rules option is
'all_rules' in a case where no matching rules are defined all
certificated will be filtered out and no ssh keys are returned.
The intention of the default was to allow the same same certificates
which are allowed in the PAM responder for authentication. The missing
default matching rule which is currently use by the PAM responder if no
other rules are available is added by this patch.
There might still be a small regression in case certificates without the
extended key usage (EKU) clientAuth were used for ssh. In this case
'ssh_use_certificate_matching_rules = no_rules' or a suitable matching
rule must be added to the configuration.
Related to https://pagure.io/SSSD/sssd/issue/4121
"""
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/1001/head:pr1001
git checkout pr1001

[sssd PR#1001][opened] ssh: fix matching rules default