NSS and PAM
des at des.no
Fri Nov 28 17:45:40 PST 2003
"Jacques A. Vidrine" <nectar at FreeBSD.org> writes:
> Interesting. Explain, please. (Maybe privately or in another thread;
> hate to keep this'n going.) Perhaps you mean that it is a design flaw
> that two APIs are required. If so, I happen to disagree; I think that
> the separation of directory services and authentication is appropriate
> and necessary.
No, the two are essentially one. We just think they aren't because
we've been brainwashed to think of users in terms of uids and gids and
especially struct passwd, which deserves to die.
NSS itself doesn't make much sense to me; it's an elaborate hack
designed to drag all those nice shiny directory services down in the
mud where struct passwd has been wallowing for the past twenty years,
instead of allowing applications to take advantage of their superior
As for PAM, a lot of what's wrong with it today could be fixed by
redesigning it to include directory services. If you fixed the
conversation system (by formalizing service function execution as an
FSM) and cleaned up the configuration syntax, you'd end up with
something quite nice.
Dag-Erling Smørgrav - des at des.no
More information about the freebsd-current