Re: NSS and PAM

From: Dag-Erling Smørgrav <des_at_des.no>
Date: Sat, 29 Nov 2003 02:45:24 +0100
"Jacques A. Vidrine" <nectar_at_FreeBSD.org> writes:
> Interesting.  Explain, please.  (Maybe privately or in another thread;
> hate to keep this'n going.)  Perhaps you mean that it is a design flaw
> that two APIs are required.  If so, I happen to disagree; I think that
> the separation of directory services and authentication is appropriate
> and necessary.

No, the two are essentially one.  We just think they aren't because
we've been brainwashed to think of users in terms of uids and gids and
especially struct passwd, which deserves to die.

NSS itself doesn't make much sense to me; it's an elaborate hack
designed to drag all those nice shiny directory services down in the
mud where struct passwd has been wallowing for the past twenty years,
instead of allowing applications to take advantage of their superior
functionality.

As for PAM, a lot of what's wrong with it today could be fixed by
redesigning it to include directory services.  If you fixed the
conversation system (by formalizing service function execution as an
FSM) and cleaned up the configuration syntax, you'd end up with
something quite nice.

DES
-- 
Dag-Erling Smørgrav - des_at_des.no
Received on Fri Nov 28 2003 - 16:45:40 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:37:31 UTC