Possible to run an IdP from /etc/passwd or NIS?

[Phil Gold]

* Cantor, Scott <cantor.2 at osu.edu> [2014-03-07 21:36 +0000]:
> On 3/7/14, 3:36 PM, "Phil Gold" <phil at cs.jhu.edu> wrote:
> >It seems that the JAAS UnixLoginModule doesn't actually do any
> >authentication, so it lets literally anything in.
> 
> That seems hard to believe, there must be something wrong with the options.

Here's how I was running it:

    ShibUserPassAuth {
      com.sun.security.auth.module.UnixLoginModule required;
    };

With that configuration, literally anything I typed into the username
field was treated as an authenticated account, regardless of what was in
the password field or whether the account actually existed on the system.

The documentation[0] only mentions UnixLoginModule supporting the `debug`
option, so I don't think there's a lot of room for using the options
incorrectly.  On top of that, I found a number of places online (e.g. [1],
[2]) that seemed to indicate that it doesn't actually do any
authentication.

  [0]: http://docs.oracle.com/javase/1.5.0/docs/guide/security/jaas/spec/com/sun/security/auth/module/UnixLoginModule.html
  [1]: http://osdir.com/ml/java.sun.jini/2005-03/msg00252.html
  [2]: https://community.oracle.com/thread/1541239

> That's really totally out of scope of anything we support

Yeah, I figured.  We have plans to move to something involving LDAP
eventually, but I've been asked to get the IdP working on a much shorter
timetable.  :-/

> You could certainly consider Apache in front and using that, which I
> imagine can handle NIS directly.

I think I can get something working with HTTP basic auth,
mod_authnz_external and the RemoteUser handler, but HTTP basic auth leaves
a lot to be desired in the user experience department.

I should be able to get everything working well enough for our purposes,
one way or the other, but I wanted to make sure I wasn't missing anything
in what Shibboleth has available already.

-- 
Phil Gold / JHU CS IT (Linux)
phil at cs.jhu.edu