i'm having a largish user-base (>>1000) which should be able to collectively use some sharing service.
the user base is slowly but constantly changing.
esp. we are not interested in privilege separation (all users are equal), so from a privilege pov they can share a single account. however, for security reasons we cannot use shared credentials. luckily all users have their own username/password available via LDAP.
so we have implemented a login server (ssh on Debian), where people are authenticated via PAM and OpenLDAP.
now the LDAP-server is not providing much information, only a username and the ability to authenticate.
esp, it lacks a
objectClass: posixAccount and accompanying attributes
my access to the LDAP-server is very limited (esp, i cannot ask for those or any other attributes to be added), basically it only allows me to authenticate the users.
now the good news is, that i don't care very much if all users have the same values for those attributes.
so I ended up implementing a proxy-ldap server that uses a
translucent overlay to add the missing attributes.
the overlay data is generated via a script that creates a stripped down LDIF-file from the upstream LDAP-data, which is then used to populate the translucent database.
this works OK, but i don't like it from a maintainability POV: because the user-base is changing, I need to regularly update the database manually (it's changing seldom enough - every few months - so it is not much work but it is also easy to forget).
because the overlay-data is so trivial (it's the same attributes/values for all objects), i think there must be a better way. ideally i would like to have an overlay, that would add those attributes to all objects (matching a given searchterm).
to complicate things a little bit, we also authenticate another user-base against another LDAP-server that does provide
posixAccount-data; users of this group should of course not be affected by all the overlay magic needed for the other group; which i think rules out any magic done on the PAM side.