State of authentication and identity in Fedora
summary
Fedora still runs identity on decades‑old POSIX APIs (1979, NSS in 1993) while packaging and tooling converge: FreeIPA, Samba, SSSD and MIT Kerberos actually implement KCM via SSSD so Kerberos ticket caches are namespace‑friendly and Fedora toolbox auto‑imports tickets into containers; Kerberos work targets Kerberos 1.18 features (SPAKE preauth, auth indicators, resource‑based delegation); SMBv1 is disabled by default; OpenLDAP is removed from RHEL; policy work, Ansible roles and Cockpit plugins plus ~300 IP/CA health checks modernize deployments.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 2:03History of APIs
- 5:11Fedora API
- 9:20Fedora modules
- 12:55SSST in Fedora
- 13:52Fedora is conservative
- 16:03Offconfig
- 18:37Offconfig refactoring
- 20:22PXIQ
- 21:47Cameras
- 24:41Kerberos
- 28:07DNS canonicalization
- 34:45Kerberos pre authentication
- 38:54Kerberos 1718
- 44:41LDAP
- 46:05Samba AD
- 49:42Provenance
- 51:42Samba
related talks
01h 09mLife beyond FIPS 140-3: identity tales
33mFIDO2 authentication for centrally managed users
24mSecurity benefits of FreeIPA/IDM
24mEnd of OpenID in Fedora
26mWho Authenticates Linux? Rethinking PAM & NSS in the Age of Cloud Identity
17mSamba 2020: Why are we still in the 1980s for authentication?
38mFreeIPA
01h 12mIdentity 2.0: the what, why and how of social and federated login