Lars Tunkrans wrote:
Hi,
We are starting to play with placing Sun-Rays in the network on
to a default Kiosk-FoG
If no-one is using a Sun Ray with a card.
Its kind of chancy if AMGH Acts on the Pseudo.xxxxxxxxxxxxxx
token and moves the DTU
to the Kiosk-FOG.
By "chancy" do you mean it doesn't always work?
Can you explain or give guidelines on what the underlying code
pre-supposes about pseudo-tokens
in respect to AMGH ? when is AMGH inwoked ? when isn't it ?
This is pretty well described in my AMGH How-To at
http://blogs.sun.com/bobd, but here are some details:
- AMGH is invoked from the PAM stack when the greeter calls
pam_authenticate().
- pseudo-tokens are handled no differently than any other tokens.
- pam_sunray_amgh.so::pam_sm_authenticate() invokes the AMGH API and
calls the customer-configured script. If any hosts are returned which
respond to SR service queries the DTU will be redirected to that host
and the left-behind greeter session will be terminated (also if any
username is returned it is carried along with the redirect and preset in
the target server's PAM context).
There are some other subtleties:
- AMGH is suppressed when utselect/utswitch is explicitly invoked to
redirect a DTU manually.
- AMGH is suppressed if a redirect has just occurred due to AMGH, unless
the initial API call returned "chain_amgh=true"
The suppression of AMGH is handled by redirect properties called
"doamgh" and "cause".
You can learn a lot by looking at the /var/opt/SUNWut/log/messages
AMGH_SUMMARY messages to see why AMGH did or did not occur.
Try to identify the steps you're taking when AMGH does and does not do
what you expected, and take especial note of Control-Moon/resets. Are
you playing with your AMGH configuration and just inserting/removing a
smartcard to test it? That likely won't work, since the underlying
pseudo session remains on the server and it's already passed its AMGH
processing step when you insert your card a 2nd time. This shouldn't
affect a real-world scenario since detached greeter sessions are
terminated after 15 minutes. You can play with reducing the
idle-session reaper's interval by copying
/etc/opt/SUNWut/reaper.conf.template to /etc/opt/SUNWut/reaper.conf and
changing the REAPER_TIMEOUT value. You can even set it to 0, although I
wouldn't do that in production since it will cause additional overhead
and might introduce some race cases.
-Bob
_______________________________________________
SunRay-Users mailing list
[email protected]
http://www.filibeto.org/mailman/listinfo/sunray-users
