SPEC: build minimal / container oriented SSSD

[alexey-tikhonov]

No description provided.

[slominskir]

This may also be useful for embedded systems as well. Systems that don't have systemd but are considering running sssd as a sidecar process to handle auth.

[alexey-tikhonov]

Hi @slominskir,

This may also be useful for embedded systems as well. Systems that don't have systemd but are considering running sssd as a sidecar process to handle auth.

Could you please explain your use case in a more details?

Does "sidecar process" means a container? If SSSD runs inside a container, it doesn't matter if host runs Systemd, it matters if Systemd runs inside that container...

Do you use SSSD to auth apps bundled into the same container or do you mount '/var/lib/sss/pipes/' from the container to the host and use 'libnss_sss.so.2' and 'pam_sss.so' on the host?

[slominskir]

Hi @alexey-tikhonov,
I'm exploring whether SSSD could be used as a generic client for Identity and Access Management as opposed to a Linux specific one. The answer may well be no. If systemd is required the answer is probably no (not practical).

Specifically, we use Red Hat Identity Manager in our network of Red Hat Linux hosts, but we also have other hosts we would like to secure. These other hosts include embedded systems running software such as RTEMS. When I say sidecar I simply mean delegate auth to the separate sssd app instead of handling it inside our own app. Ideally this would all occur on the same host, but it may be possible to network mount /var/lib/sss/pipes from a sidecar host. Any insights you can provide would be appreciated.

[alexey-tikhonov]

Hi @alexey-tikhonov, I'm exploring whether SSSD could be used as a generic client for Identity and Access Management as opposed to a Linux specific one. The answer may well be no. If systemd is required the answer is probably no (not practical).

You can build and use SSSD without Systemd dependency. This PR can be considered as an example.

But I don't know if RTEMS has all required deps, if it's POSIX compatible, etc. I.e. I don't know if you can build natively for RTEMS.

Specifically, we use Red Hat Identity Manager in our network of Red Hat Linux hosts, but we also have other hosts we would like to secure. These other hosts include embedded systems running software such as RTEMS. When I say sidecar I simply mean delegate auth to the separate sssd app instead of handling it inside our own app.

I see, this has nothing to do with "containers" per se.