NSS and PAM
Richard Coleman
richardcoleman at mindspring.com
Fri Nov 28 21:36:16 PST 2003
Dag-Erling Smørgrav wrote:
> NSS itself doesn't make much sense to me; it's an elaborate hack
> designed to drag all those nice shiny directory services down in the
> mud where struct passwd has been wallowing for the past twenty years,
> instead of allowing applications to take advantage of their superior
> functionality.
>
> As for PAM, a lot of what's wrong with it today could be fixed by
> redesigning it to include directory services. If you fixed the
> conversation system (by formalizing service function execution as an
> FSM) and cleaned up the configuration syntax, you'd end up with
> something quite nice.
>
> DES
Replacing passwd/group/NSS/PAM/whatever with a real database or
directory backend is a kind of holy grail for Unix that's been discussed
for many years. I would love to see it happen. But I doubt it could
ever happen within a collaborative project like FreeBSD, since it would
be impossible to get enough people to agree upon the innumerable small
details. I don't want to sound so pessimistic, but I think that's just
a reality of group projects.
I think this is part of the reason that many people are passionate about
the dynamic library implementation of PAM/NSS. We realize that the odds
are very high that the alternatives will be endlessly discussed, but
never implemented. Since this is a feature that many of us really need,
we prefer the less than perfect but existing implementation to the
perfect, but never implemented solution.
This discussion has really reminded me of the classic paper by Richard
Gabriel on "Lisp: Good News, Bad News, How to Win Big". This is one of
the best essays on the "Worse is Better" phenomenon.
http://www.ai.mit.edu/docs/articles/good-news/good-news.html
http://www.dreamsongs.com/WorseIsBetter.html
Richard Coleman
richardcoleman at mindspring.com
More information about the freebsd-current
mailing list