Possible to run an IdP from /etc/passwd or NIS?

[Douglas E Engert]

On 3/7/2014 2:36 PM, Phil Gold wrote:
> I run a bunch of systems that use NIS for identity management (and which
> aren't going to use anything else in the near future, at least).  I've
> been asked to set up an IdP that uses these NIS accounts for
> authentication.  I don't seem to be having success with this so I'm hoping
> someone here can point me in the right direction.
>
> I'm trying to use the UsernamePassword LoginHandler, but I haven't had
> much luck.  It seems that the JAAS UnixLoginModule doesn't actually do any
> authentication, so it lets literally anything in.

http://docs.oracle.com/javase/1.5.0/docs/guide/security/jaas/spec/com/sun/security/auth/module/UnixLoginModule.html

implies it takes the UID and username and GID from the user running the VM. i.e. the IDP!

>    I've tried the
> JndiLoginModule with the following configuration:
>
>      ShibUserPassAuth {
>        com.sun.security.auth.module.JndiLoginModule required
>          user.provider.url="nis://nis.example.com/example.com/user"
>          group.provider.url="nis://nis.example.com/example.com/system/group";
>      };

I have not used NIS in years, but  NIS may require the IDP to run as root to get the password. Its worth a test.


>
> but a) it appears to fail every login attempt, and b) I don't see any
> network traffic between the IdP and the NIS server.
>
> Am I using JndiLoginModule correctly?  Is there a different JAAS module
> that would work better?  Is there a different LoginHandler I should be
> using?
>
> (While I'm at it, is there a way to get Unix account information into SAML
> attributes?  I'd really like to have group membership available and the
> GECOS information would be nice, too.)
>
> In case it makes a difference, I'm running version 2.4.0 of the IdP on
> Tomcat 6.0.24 installed from RPM onto a RHEL 6.5 system.
>

-- 

  Douglas E. Engert  <DEEngert at gmail.com>