Date: Mon, 1 Dec 2003 12:14:23 -0500 (EST) From: Robert Watson <rwatson@FreeBSD.org> To: Dag-Erling =?iso-8859-1?q?Sm=F8rgrav?= <des@des.no> Cc: freebsd-current@FreeBSD.org Subject: Re: NSS and PAM Message-ID: <Pine.NEB.3.96L.1031201115701.49130A-100000@fledge.watson.org> In-Reply-To: <xzp7k1geb6x.fsf@dwp.des.no>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, 1 Dec 2003, Dag-Erling Sm=F8rgrav wrote:
> "Jacques A. Vidrine" <nectar@FreeBSD.org> writes:
> > By `the two', do you mean directory services and authentication? They
> > are certainly not `essentially one'. But I suspect you know this and
> > I am just misunderstanding your meaning.
>=20
> They are different issues, but in this context you can't discuss one
> without the other. Authentication doesn't work unless you have a user
> to authenticate. It makes no sense to separate them; you just end up
> duplicating a lot of concepts and code.=20
>=20
> Also, is changing your password an authentication function or a
> directory function? I don't think you can answer either without
> answering both.=20
It strikes me that there are two separate issues:
(1) Whether or not there's a useful distinction between authentication
services and directory services.
(2) If there is or isn't such a distinction in (1), whether or not that
distinction should appear in the implementation.
In practice, people frequently mix and match authentication services and
directory services, and there are services that implement one but not the
other. For example, Kerberos5 for authentication an LDAP for directory
services is a common combination: however, Kerberos doesn't provide
directory services, only principal authentication. Likewise, even on
purely local systems, the account directory services (pwent, et al) may be
distinct from principal authentication using one-time passwords, etc. I'm
not opposed to the fundamental idea of combining mechanism, but there are
some practical underlying differences between directory services and
authentication, even though there's clear overlap.=20
Robert N M Watson FreeBSD Core Team, TrustedBSD Projects
robert@fledge.watson.org Senior Research Scientist, McAfee Research
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.NEB.3.96L.1031201115701.49130A-100000>