Re: NSS and PAM

"Jacques A. Vidrine" <nectar_at_FreeBSD.org> writes:
> By `the two', do you mean directory services and authentication?  They
> are certainly not `essentially one'.  But I suspect you know this and
> I am just misunderstanding your meaning.

They are different issues, but in this context you can't discuss one
without the other.  Authentication doesn't work unless you have a user
to authenticate.  It makes no sense to separate them; you just end up
duplicating a lot of concepts and code.

Also, is changing your password an authentication function or a
directory function?  I don't think you can answer either without
answering both.

> I guess I think of it this way.  If NSS had not been implemented
> `down in the mud' (inside getpw*, getgr*, gethostby*, etc.), then
> applications that used the UNIX directory service APIs would need to
> be re-written in order to utilize NSS.  That's a lot of code to change
> for little benefit.

Backward compatibility is fine, but NSS does not seem to export an API
that we can use when we want to lift ourselves out of the mud, so we
are forced to keep rooting around in it.  One consequence of this (and
of the artificial separation between NSS and PAM) is that passwd(1)
doesn't work properly except in the simplest cases.

> If I understand you correctly, you believe that it would be possible
> to unite the NSS and PAM switches, so that they used the same
> configuration file, dynamic loading mechanisms, cascading, and so
> on.  Sure, I think that's possible.  There might even be some benefit,
> though probably not enough benefit to abandon PAM/NSS and go our own
> way.

Not to go our own way, no.  There's the rub.  It would have to be a
reasonably wide effort; we'd need to get at least one major Linux
distro to adopt the same infrastructure.

DES
-- 
Dag-Erling Smørgrav - des_at_des.no