NetworkAuthClient

Differences between revisions 5 and 6
Revision 5 as of 2006-11-08 19:31:45
Size: 3006
Editor: 207
Comment:
Revision 6 as of 2006-11-10 17:25:36
Size: 3138
Editor: 207
Comment: typography, and a comment
Deletions are marked like this. Additions are marked like this.
Line 6: Line 6:
Authenticating edubuntu clients (workstations and ltsp servers) against an edubuntu network auth server. Authenticating Edubuntu clients (workstations and LTSP servers) against an Edubuntu network auth server.
Line 10: Line 10:
To provide a centralized usermanagement in a school using edubuntu, an edubuntu network authentication server is implemented. To authenticate against such a server a certain client setup is required. This spec outlines what will be done to achieve client authentication on edubuntu ltsp servers and workstations. To provide centralized user management in a school using Edubuntu, an [https://features.launchpad.net/distros/ubuntu/+spec/edubuntu-network-auth-server Edubuntu network authentication server] is implemented. To authenticate against such a server a certain client setup is required. This spec outlines what will be done to achieve client authentication on Edubuntu LTSP servers and workstations.
Line 14: Line 14:
Will is administrator at a highschool, he used to use an edubuntu LTSP server in one classroom to test the functionallity. Since the software convinced him he will now set up his whole school with edubuntu and set up an edubuntu network authentication server where he maintains the students accounts for the complete school and their homedirectories. After he installed the edubuntu-auth-client metapackage on all his workstations and ltsp servers all his students log in via the centralized service without problems. Will is an administrator at a high school. He used to use an Edubuntu LTSP server in one classroom to test the functionality. Since the software convinced him, he will now set up his whole school with Edubuntu and set up an Edubuntu network authentication server where he maintains the students' accounts for the whole school and their home directories. After he installed the edubuntu-auth-client metapackage on all his workstations and LTSP servers, all his students log in via the centralized service without problems.
Line 18: Line 18:
Out of the box working authentication against an edubuntu network authserver. Out of the box working authentication against an Edubuntu network authserver.
Line 23: Line 23:
It will depend on https://launchpad.net/people/ajmitch/+branch/network-authentication/authtool (which will provide the basic authentication functionallity) as well as on libpam-mount, libpam-ldap, libnss-ldap and libpam-ccreds. It will depend on https://launchpad.net/people/ajmitch/+branch/network-authentication/authtool (which will provide the basic authentication functionality) as well as on libpam-mount, libpam-ldap, libnss-ldap and libpam-ccreds.
Line 27: Line 27:
Additionally a dependency on the edsadmin package (handled in edubuntu-auth-server) will be created. In the postinst of the edubuntu-auth-client the menu entry of the users-admin tool shipped gnome-system-tools will be disabled to avoid the confusion of having two user management tools. A dependency on the edsadmin package (handled in edubuntu-auth-server) will be created. In the postinst of the edubuntu-auth-client package, the menu entry of the users-admin tool shipped by gnome-system-tools will be disabled to avoid the confusion of having two user management tools.
Line 29: Line 29:
The postinst of edubuntu-auth-client will ask for the desired domainname and for the ip address of the ldap server and preseed the authtool debconf values with it. The postinst of edubuntu-auth-client will ask for the desired domain name and for the IP address of the LDAP server and preseed the authtool debconf values with it.
Line 31: Line 31:
The edubuntu CD will get a new networked-workstation preseed file that pulls in the edubuntu-auth-client package. This way the user will still have the option to install a complete standalone workstation. The Edubuntu CD will get a new networked-workstation preseed file that pulls in the edubuntu-auth-client package. This way the user will still have the option to install a complete standalone workstation.
Line 35: Line 35:
For mounting /home a nfs export in required on the authentication server, the edubuntu-auth-server will care for this. For mounting /home an NFS export is required on the authentication server, the edubuntu-auth-server will care for this.
Line 37: Line 37:
The password tool of the "About Me" application shipped by default in ubuntu/edubuntu will be enhanced to operate properly with the users password on an ldap server. The password tool of the "About Me" application shipped by default in Ubuntu/Edubuntu will be enhanced to operate properly with the user's password on an LDAP server.
Line 41: Line 41:
The pam-mount binary needs to be extended to read the users home directory location from the ldap server where we store the information where to find the users home. The pam-mount binary needs to be extended to read the user's home directory location from the LDAP server.
 * Is making it use libpam-ldap not enough? Does it do hardcoded stuff
with /etc/passwd? --ColinWatson

Summary

Authenticating Edubuntu clients (workstations and LTSP servers) against an Edubuntu network auth server.

Rationale

To provide centralized user management in a school using Edubuntu, an [https://features.launchpad.net/distros/ubuntu/+spec/edubuntu-network-auth-server Edubuntu network authentication server] is implemented. To authenticate against such a server a certain client setup is required. This spec outlines what will be done to achieve client authentication on Edubuntu LTSP servers and workstations.

Use cases

Will is an administrator at a high school. He used to use an Edubuntu LTSP server in one classroom to test the functionality. Since the software convinced him, he will now set up his whole school with Edubuntu and set up an Edubuntu network authentication server where he maintains the students' accounts for the whole school and their home directories. After he installed the edubuntu-auth-client metapackage on all his workstations and LTSP servers, all his students log in via the centralized service without problems.

Scope

Out of the box working authentication against an Edubuntu network authserver.

Design and Implementation

A metapackage called edubuntu-auth-client will be created. It will depend on https://launchpad.net/people/ajmitch/+branch/network-authentication/authtool (which will provide the basic authentication functionality) as well as on libpam-mount, libpam-ldap, libnss-ldap and libpam-ccreds.

The libpam-mount, libpam-ldap, libnss-ldap and libpam-ccreds packages will move to main.

A dependency on the edsadmin package (handled in edubuntu-auth-server) will be created. In the postinst of the edubuntu-auth-client package, the menu entry of the users-admin tool shipped by gnome-system-tools will be disabled to avoid the confusion of having two user management tools.

The postinst of edubuntu-auth-client will ask for the desired domain name and for the IP address of the LDAP server and preseed the authtool debconf values with it.

The Edubuntu CD will get a new networked-workstation preseed file that pulls in the edubuntu-auth-client package. This way the user will still have the option to install a complete standalone workstation.

Edubuntu LTSP server installs will install the edubuntu-auth-client by default.

For mounting /home an NFS export is required on the authentication server, the edubuntu-auth-server will care for this.

The password tool of the "About Me" application shipped by default in Ubuntu/Edubuntu will be enhanced to operate properly with the user's password on an LDAP server.

Unresolved issues

The pam-mount binary needs to be extended to read the user's home directory location from the LDAP server.

  • Is making it use libpam-ldap not enough? Does it do hardcoded stuff with /etc/passwd? --ColinWatson


CategorySpec

Edubuntu/Specifications/NetworkAuthClient (last edited 2010-01-21 19:01:15 by 196-210-177-89-wblv-esr-3)