pam: use a pam object method instead of pam module function

[cascardo/ipsilon.git] / README

diff --git a/README b/README
index ae0c46f..9bde0cc 100644 (file)
--- a/README
+++ b/README
@@ -14,7 +14,8 @@ completely agnostic of what authentication infrastructure is being used.
 Applications can currently use the SAML2[2] protocol to talk to the Ipsilon
 identity provider, an application that uses SAML is called a Service Provider.
 
 Applications can currently use the SAML2[2] protocol to talk to the Ipsilon
 identity provider, an application that uses SAML is called a Service Provider.
 

-Ipsilon uses the LASSO[3] libraries an Python bindings to implement SAML support.
+Ipsilon uses the LASSO[3] libraries and Python bindings to implement SAML
+support.

 
 Ipsilon Server Installation
 ===========================
 
 Ipsilon Server Installation
 ===========================


@@ -27,9 +28,9 @@ Prerequisites:
 - A keytab if Kerberos authentication is desired
 - An unprivileged user to run the Ipsilon code (defaults to 'ipsilon')
 
 - A keytab if Kerberos authentication is desired
 - An unprivileged user to run the Ipsilon code (defaults to 'ipsilon')
 

-Currently there are only two available authentication modules, Kerberos and
-PAM. The Kerberos module uses mod_auth_kerb (which it will configure for you at
-install time), the Pam module simply uses the PAM stack with a default service
+Currently there are only two available authentication modules, GSSAPI and
+PAM. The Kerberos module uses mod_auth_gssapi (which it will configure for
+you at install time), the Pam module simply uses the PAM stack with a default service

 name set to 'remote'.
 
 NOTE: The PAM module is invoked as an unprivileged user so if you are using the
 name set to 'remote'.
 
 NOTE: The PAM module is invoked as an unprivileged user so if you are using the


@@ -38,7 +39,7 @@ not work properly. Please use a different PAM module, like pam_sss, pam_ldap,
 etc..
 
 Before you run the install script make sure to create an administrative user
 etc..
 
 Before you run the install script make sure to create an administrative user

-that can be authenticated either via PAM or Kerberos. The default name the
+that can be authenticated either via PAM or GSSAPI. The default name the

 installation script expects is 'admin' but that can be changed with the command
 line option named --admin-user
 
 installation script expects is 'admin' but that can be changed with the command
 line option named --admin-user
 


@@ -49,9 +50,10 @@ name is referenced and resolved by remote clients.
 
 Other options are available by running ipsilon-server-install --help
 
 
 Other options are available by running ipsilon-server-install --help
 

-To install a server that allow both Kerberos and PAM authentication use:
+To install a server that allow both GSSAPI (Kerberos) and PAM authentication
+use:

 
 

- $ ipsilon-server-install --krb=yes --pam=yes
+ $ ipsilon-server-install --gssapi=yes --pam=yes

 
 This command will generate a default instance called 'idp' (you can change the
 default name using the --instance switch). Multiple instance can be installed
 
 This command will generate a default instance called 'idp' (you can change the
 default name using the --instance switch). Multiple instance can be installed


@@ -67,7 +69,12 @@ The install script expects to find the keytab in /etc/httpd/conf/http.keytab
 NOTE: If you are installing Ipsilon in a FreeIPA[4] environment you can use the
 --ipa switch to simplify the deployment. Using the --ipa switch will allow the
 use of your IPA Kerberos administrative credentials to automatically provision
 NOTE: If you are installing Ipsilon in a FreeIPA[4] environment you can use the
 --ipa switch to simplify the deployment. Using the --ipa switch will allow the
 use of your IPA Kerberos administrative credentials to automatically provision

-a keytab for the HTTP service if one is not available yet.
+a keytab for the HTTP service if one is not available yet.  You will likely
+want to use the --admin-user option to specify the full principal of the user
+who will administer Ipsilon.  For example to use the FreeIPA admin user for
+the EXAMPLE.COM realm, you would use:
+
+ $ ipsilon-server-install --ipa --admin-user admin@EXAMPLE.COM

 
 Once the script has successfully completed the installation, restart the Apache
 HTTPD server to activate it.
 
 Once the script has successfully completed the installation, restart the Apache
 HTTPD server to activate it.