Today, the last piece of the puzzle for roaming laptops in Debian +Edu finally entered the Debian archive. Today, the new +libpam-mklocaluser +package was accepted. Two days ago, two other pieces was accepted +into unstable. The +pam-python +package needed by libpam-mklocaluser, and the +sssd package +passed NEW on Monday. In addition, the +libpam-ccreds +package we need is in experimental (version 10-4) since Saturday, and +hopefully will be moved to unstable soon.
+ +This collection of packages allow for two different setups for +roaming laptops. The traditional setup would be using libpam-ccreds, +nscd and libpam-mklocaluser with LDAP or Kerberos authentication, +which should work out of the box if the configuration changes proposed +for nscd in BTS report +#485282 is implemented. The alternative setup is to use sssd with +libpam-mklocaluser to connect to LDAP or Kerberos and let sssd take +care of the caching of passwords and group information.
+ +I have so far been unable to get sssd to work with the LDAP server +at the University, but suspect the issue is some SSL/GnuTLS related +problem with the server certificate. I plan to update the Debian +package to version 1.2, which is scheduled for next week, and hope to +find time to make sure the next release will include both the +Debian/Ubuntu specific patches. Upstream is friendly and responsive, +and I am sure we will find a good solution.
+ +The idea is to set up the roaming laptops to authenticate using +LDAP or Kerberos and create a local user with home directory in /home/ +when a usre in LDAP logs in via KDM or GDM for the first time, and +cache the password for offline checking, as well as caching group +memberhips and other relevant LDAP information. The +libpam-mklocaluser package was created to make sure the local home +directory is in /home/, instead of /site/server/directory/ which would +be the home directory if pam_mkhomedir was used. To avoid confusion +with support requests and configuration, we do not want local laptops +to have users in a path that is used for the same users home directory +on the home directory servers.
+ +One annoying problem with gdm is that it do not show the PAM +message passed to the user from libpam-mklocaluser when the local user +is created. Instead gdm simply reject the login with some generic +message. The message is shown in kdm, ssh and login, so I guess it is +a bug in gdm. Have not investigated if there is some other message +type that can be used instead to get gdm to also show the message.
+ +If you want to help out with implementing this for Debian Edu, +please contact us on debian-edu@lists.debian.org.
+ +