From owner-freebsd-isp Tue Nov 14 12:37:59 2000 Delivered-To: freebsd-isp@freebsd.org Received: from greencreek.kappaisle.com (24.65.73.235.on.wave.home.com [24.65.73.235]) by hub.freebsd.org (Postfix) with ESMTP id B975E37B4C5; Tue, 14 Nov 2000 12:37:52 -0800 (PST) Received: from localhost (mikey@localhost) by greencreek.kappaisle.com (8.9.3/8.9.3) with ESMTP id PAA92301; Tue, 14 Nov 2000 15:54:55 -0500 (EST) (envelope-from mikey@kappaisle.com) Date: Tue, 14 Nov 2000 15:54:55 -0500 (EST) From: Mike To: "Jacques A. Vidrine" Cc: freebsd-questions@freebsd.org, freebsd-isp@freebsd.org Subject: Re: pam_ldap status? In-Reply-To: <20001114142137.A7172@hamlet.nectar.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-isp@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Thanks alot Jacques, it really gives me a much more clear view on the differences. I'm looking forward to integrating LDAP authentication for our shell/pop/imap/ftp/web/ssh users. Mike On Tue, 14 Nov 2000, Jacques A. Vidrine wrote: > On Tue, Nov 14, 2000 at 02:21:49PM -0500, Mike wrote: > > Hello all, > > > > What's the update on the pam_ldap development? Is FreeBSD ready for LDAP > > authentication and overcome the NSS issue? > > You seem to be mixing up two mechanisms: PAM (Pluggable Authentication > Modules) and NSS/nsswitch (Name Service Switch). > > > The former (PAM) is a mechanism for authenticating a user interactively > using a user name and password. For LDAP, you can use pam_ldap from > http://www.pdal.com/pam_ldap.html. PAM is supported by several > platforms (at least Solaris, Linux, and FreeBSD) and the interfaces are > very similar. > > The latter (nsswitch) is intended to `switch' between different sources > as used by gethostbyname, getpwent, getgrent, et cetera. The version of > nsswitch that is available in FreeBSD-CURRENT (and NetBSD) supports > files (e.g. /etc/passwd, /etc/hosts), NIS, and Hesiod as sources. > nsswitch is supported by at least Solaris, Linux, and (Free|Net)BSD, but > the interfaces are necessarily different between the three. > > I have further developed a version for FreeBSD that allows additional > sources to be added as dynamic modules, and have ported nss_ldap from > http://www.padl.com/nss_ldap.html for use with it. You can find the > software at http://www.nectar.com/freebsd/nsswitch. It is a work in > progress, although I believe it is completely functional [1]. I expect > it will be ready to commit to -CURRENT sometime next month. > > > I hope this information helps, > -- > Jacques Vidrine / n@nectar.com / jvidrine@verio.net / nectar@FreeBSD.org > > > [1] The primary deficiency is that the NetBSD nsswitch API is not quite > sufficient for all types of sources. Luke Mewburn > and I are hashing out an API that both platforms (FreeBSD and NetBSD) > will be able to use -- shortly after we have that settled, I think this > nsswitch implementation will be ready for -CURRENT. > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-isp" in the body of the message