The translation is temporarily closed for contributions due to maintenance, please come back later.
Zen

Source string Source string

218/10000 · 218

This translation is currently locked.

English Actions
PROMPTING CONFIGURATION SECTION
If a special file (<filename>/var/lib/sss/pubconf/pam_preauth_available</filename>) exists SSSD's PAM module pam_sss will ask SSSD to figure out which authentication methods are available for the user trying to log in. Based on the results pam_sss will prompt the user for appropriate credentials.
With the growing number of authentication methods and the possibility that there are multiple ones for a single user the heuristic used by pam_sss to select the prompting might not be suitable for all use cases. To following options should provide a better flexibility here.
[prompting/password]
password_prompt
to change the string of the password prompt
to configure password prompting, allowed options are: <placeholder type="variablelist" id="0"/>
[prompting/2fa]
first_prompt
to change the string of the prompt for the first factor
second_prompt
to change the string of the prompt for the second factor
single_prompt
boolean value, if True there will be only a single prompt using the value of first_prompt where it is expected that both factor are entered as a single string
to configure two-factor authentication prompting, allowed options are: <placeholder type="variablelist" id="0"/>
Each supported authentication method has it's own configuration sub-section under <quote>[prompting/...]</quote>. Currently there are: <placeholder type="variablelist" id="0"/> <placeholder type="variablelist" id="1"/>
It is possible to add a sub-section for specific PAM services like e.g. <quote>[prompting/password/sshd]</quote> to individual change the prompting for this service.
CERTIFICATE MAPPING SECTION
To allow authentication with Smartcards and certificates SSSD must be able to map certificates to users. This can be done by adding the full certificate to the LDAP object of the user or to a local override. While using the full certificate is required to use the Smartcard authentication feature of SSH (see <citerefentry> <refentrytitle>sss_ssh_authorizedkeys</refentrytitle> <manvolnum>8</manvolnum> </citerefentry> for details) it might be cumbersome or not even possible to do this for the general case where local services use PAM for authentication.
To make the mapping more flexible mapping and matching rules were added to SSSD (see <citerefentry> <refentrytitle>sss-certmap</refentrytitle> <manvolnum>5</manvolnum> </citerefentry> for details).
A mapping and matching rule can be added to the SSSD configuration in a section on its own with a name like <quote>[certmap/<replaceable>DOMAIN_NAME</replaceable>/<replaceable>RULE_NAME</replaceable>]</quote>. In this section the following options are allowed:
matchrule (string)
Only certificates from the Smartcard which matches this rule will be processed, all others are ignored.
Default: KRB5:&lt;EKU&gt;clientAuth, i.e. only certificates which have the Extended Key Usage <quote>clientAuth</quote>
maprule (string)
Defines how the user is found for a given certificate.
LDAP:(userCertificate;binary={cert!bin}) for LDAP based providers like <quote>ldap</quote>, <quote>AD</quote> or <quote>ipa</quote>.
The RULE_NAME for the <quote>files</quote> provider which tries to find a user with the same name.
domains (string)
Comma separated list of domain names the rule should be applied. By default a rule is only valid in the domain configured in sssd.conf. If the provider supports subdomains this option can be used to add the rule to subdomains as well.
Default: the configured domain in sssd.conf

Loading…

User avatar None

Source string added

  1. SSSD
  2. sssd-manpages-1-16
  3. English
Each supported authentication method has it's own configuration sub-section under <quote>[prompting/...]</quote>. Currently there are: <placeholder type="variablelist" id="0"/> <placeholder type="variablelist" id="1"/>
3 years ago
Browse all string changes

Things to check

Ellipsis

The string uses three dots (...) instead of an ellipsis character (…)

Reset

Glossary

English English
No related strings found in the glossary.

String information

Source string description
type: Content of: <reference><refentry><refsect1><para>
Flags
read-only
Source string location
sssd.conf.5.xml:3407
String age
3 years ago
Last updated
10 months ago
Source string age
3 years ago
Translation file
src/man/po/sssd-docs.pot, string 626