[Freeipa-devel] [RFC] Smartcard authentication with PKINIT and local authentication

[Sumit Bose]

Hi,

with the recent addition of PKINIT support there is now a second method
available to Smartcard authentication besides local authentication.

I was about to add some sssd.conf option which can control the fallback
to local authentication if PKINIT fails. Currently there is only a
fallback to local authentication if the backend is offline or if PKINIT
is not available because either the client or the server side do not
support it.

It came to my mind that it might be more flexible to add the fallback
scheme to the certificate matching rules discussed earlier on this list.
With this it would be possible e.g. to require PKINIT for a set of
certificates and allow local authentication to a different set.

Do you think this would make sense or is it sufficient an option in
sssd.conf which covers all certificates?

bye,
Sumit