Changeset 176
Legend:
- Unmodified
- Added
- Removed
-
trunk/ChangeLog
r167 r176 1 08- Sep 2005 2 - Fixes to pam_pkcs11.spec 3 1 4 07- Sep 2005 2 5 - Conditional compilation of pcsc-lite, curl and ldap dependent -
trunk/NEWS
r9 r176 1 12- Sep 2005 2 - Finally pam_pkcs11-0.5.3 is out. 3 - New mapper API and Docs 4 - Full documentation available 5 - New mappers: openssh, openssl, ldap, generic and more 6 1 7 12- Apr 2005 2 8 - Changed name to pam_pkcs11 -
trunk/doc/README.mappers
r17 r176 9 9 cert-to-user mapping. 10 10 11 pam-pkcs11 cert mappers provides twofunctions:11 pam-pkcs11 cert mappers provides several functions: 12 12 13 13 1- Deduce a login from certificate 14 14 2- Test if a login and a certificate match 15 3- Look into the certificate for an specific data 15 16 16 17 Normal pam-pkcs11 login process involves the following procedures 17 - Enter 18 - Enter login 18 19 - Ask for PIN 19 20 - Open and validate certificate … … 37 38 -------------------------------------------- 38 39 39 pam-pkcs11 implements cert mapper in form of dynamic loaded modules. 40 pam-pkcs11 implements cert mapper in form of several stackable modules. 41 Most of them are statically linked; those that depends on external 42 libraries are provided as dynamic loadable ones 43 40 44 You can add as many modules as desired, and the system will try all 41 45 of them in turn, until a match succeed, or end of list is reached. … … 53 57 } 54 58 59 Unless you are going to use an internal (static) module with 60 default values, you should provide a entry for every declared mapper 61 55 62 "module" entry is mandatory: is tells pam_pkcs11 where to find the 56 dynamic library . Additional entries can be defined but are module57 dependent.63 dynamic library (or equals to "internal" if static module is used). 64 Additional entries can be defined but are module dependent. 58 65 59 66 … … 94 101 module the mapping between Cert fields and LDAP entries 95 102 96 This mapper is still under development 103 This mapper is still under development. Provided one just search 104 for certificates, incoming one will ask for "any" certificate 105 content 97 106 98 opensc - Search the certificate public key in 99 ${HOME}/.ssh/autorized_keys in a similar way as OpenSC does. 100 When used as login finder, returns "nobody" 107 opensc - Search the certificate ${HOME}/.ssh/autorized_certificates 108 in a similar way as OpenSC does. 101 109 102 this mapper is still under development 110 openssh - Search the certificate public key in 111 ${HOME}/.ssh/autorized_keys in a similar way as OpenSSH does. 103 112 104 113 mail - Try to extract an e-mail from the certificate. If found, … … 132 141 krb - Try to find and use Kerberos Principal Name as login name 133 142 134 This mapper needs to be written135 136 143 uid - Use Unique ID field (if found) as login name 137 144 … … 154 161 ------------------ 155 162 156 Creating new mappers is easy: just read mapper.h file, provide a file157 that exports the required functions, and modify file158 src/mappers/Makefile.am 163 Creating new mappers is easy: just read provided Mapper API file, 164 edit skeleton sample files and follow instructions on how to compile 165 and link 159 166 160 Mapper.h provides default implementation for required exports. They 161 should be overriden by user code, but can be used for testing purposes 162 167 Mapper.h provides default implementation for required some functions. 168 They should be overriden by user code, but can be used for testing purposes 163 169 164 170 Wish list 165 171 --------- 166 172 167 - Implement ldap and kerberos mappers168 173 - Implement PKINIT draft protocol for talking to a kerberos server 169 174 - Use MS Universal Principal Name to autenticate against an MS Active … … 171 176 - Implement mail_aliases parsing for mail mapper module 172 177 173 174 178 Further information 175 179 ------------------- 176 180 Please, send mail with patches, comments and suggestions to 177 Juan Antonio Martinez <jonsito@teleline.es> 181 Juan Antonio Martinez <jonsito@teleline.es> or even better, to 182 OpenSC development mailing list opensc-devel@list.opensc.org 178 183
