Re: [systemd-devel] RFC: userdb authentication protocol

2025-07-22 Thread Adrian Vovk
Hi all, I'm packing for travel today, so unfortunately I'm not fully read up on the thread. However, I wanted to leave a comment about this so that the conversation is informed by it There are ongoing conversations between the GDM devs, KDE/SDDM/PlasmaDM devs, and systemd upstream about "upstream

Re: [systemd-devel] RFC: userdb authentication protocol

2025-07-22 Thread Dominik George
Hi Thorsten, > > I am confident you did not read my proposal. > > I did read it, but you started right from the beginning with a > technical solution without explaining the problem you want to solve. > Reverse engineering the problem from a proposal is pretty hard and > leads most of the time to

Re: [systemd-devel] RFC: userdb authentication protocol

2025-07-22 Thread Thorsten Kukuk
On Tue, Jul 22, 2025 at 9:53 AM Dominik George wrote: > > Hi Thorsten, > > > But this is also the advantage: since it is so old, everything out > > there in the world is supporting it. If you come with a systemd only > > solution: there are also systems without systemd, and ISVs will not > > suppo

Re: [systemd-devel] RFC: userdb authentication protocol

2025-07-22 Thread Dominik George
Hi Thorsten, > But this is also the advantage: since it is so old, everything out > there in the world is supporting it. If you come with a systemd only > solution: there are also systems without systemd, and ISVs will not > support two solutions. So whatever you plan, make sure it can be > called

Re: [systemd-devel] RFC: userdb authentication protocol

2025-07-22 Thread Thorsten Kukuk
On Mon, Jul 21, 2025 at 12:47 PM Dominik George wrote: > > Hi, > > currently, the userdb system only allows querying for User Records and > Group Records, hence providing a modern replacement for NSS. > > I would like to propose an addition to make it support authentication as > well. The addition

Re: [systemd-devel] RFC: userdb authentication protocol

2025-07-22 Thread Dominik George
Hi Erin, thanks for the feedback! > Whatever such a protocol ends up looking like, I think “you could replace > pam_systemd_home with a generic UserDB PAM module and said generic protocol” > is an important criterion Yep. Please note that I am specifically targeting the PAM auth call (and pro

Re: [systemd-devel] RFC: userdb authentication protocol

2025-07-21 Thread Erin Shepherd
So you’ve brought something up that has certainly been ticking over in the back of my mind for a long time. I’m roughly 90% certain that the user DB interface is indeed the right extension point for hooking authentication systems into the system (And would be a better one than having to write a

[systemd-devel] RFC: userdb authentication protocol

2025-07-21 Thread Dominik George
Hi, currently, the userdb system only allows querying for User Records and Group Records, hence providing a modern replacement for NSS. I would like to propose an addition to make it support authentication as well. The additions to the io.systemd.UserDatabase Varlink interface are: ```varlink #