It's good to be back here in Brussels for for them today we are going to present
a journey how the possible result indication in GDM feature that we are currently working on.
So let's start with myself so my name is Iker Pedroza I'm a senior software engineer working
at Red Hat my main identity is about identity management and well I work in
projects like SSD shadow and Linux pump I also maintain shadow upstream and well now
John will present himself so hello everybody I'm John this is my first time at first
then I work at Red Hat in the desktop team and I work in GDM which is the login screen
and also no remote desktop and related stuff one thing about me is that last year I started
playing commander the magic the gathering TCG and I love it okay so let's take a look
at the agenda we will start to speak in about Gotis pass was there authentication I'm given
a little bit of an introduction then we will move on about the GDM authentication and how
it works currently we will explain the limitations and the solution that we are working on
and we'll find finish with a conglash so regarding partners authentication what it is
well it is a way to authenticate a user without using a password okay that makes sense
it usually involves multifactor authentication like appearing a figure print or fashion
recognition and singers I know it extrinses the security and improves the user experience
by relying on public cryptography instead of user brains to retain hundreds or even thousands
of secrets and these reduces the risk of adaptable rich and reduces the fees interests so in
free API and SSD we currently support three different mechanisms for passwordless for
centrally managed users the first one is pesky or the fiddle to token that you see there
the second one is a smart card or PIV and finally we have a standard ID providers that we provide
through the of two protocol so now I will give the floor to John who will explain the current
situation so GDM authentication so what's GDM so GDM is the
GNOME display manager and is the program inserts of authenticate in the user graphically
and a starting user session so usually when you use it you would do a password authentication
as you see here but it can also do a smart card authentication if you enable it in GDM settings
and map a smart card certificate with a user you might be able to get these certificates list
insert your pin and authenticate and also it allows to do finger print authentication the same thing
you have to enable it in GDM settings you map a fingerprint with your username and then you see
this little message there that is saying that if you place your finger on the reader you might
authenticate with your fingerprint so now probably most of the people here is wondering
and how does GDM authentication so well I'm going to explain it now so what you see here actually
is the GNOME cell the GNOME cell is the program that renders stuff and shows it on the display
and this is a special GNOME cell is the greeter GNOME cell that is running as an
GNOME privilege user called the GDM greeter user so to authenticate we need some permissions
that the GDM greeter user doesn't have so how does it do the authentication well obviously
communicating with GDM so GDM for its greeter GNOME cell is going to create to
private debug servers one to communicate with the GNOME cell and the other one to have a
panconversation and it's private because some sensitive information is being exchanged
so now moving on the GNOME cell site so in this private debug server GDM is going to expose
a user verifier interface and it's going to be used by both sites so usually when you are going to
authenticate your select your user and then the GNOME cell is going to call the
Inverification method with the authentication the pan service that is going to be used if
you are doing password authentication it will pass GDM password and pan service but if it was
using a smart authentication it would use the GDM smart car pan service then GDM is going to send
some signals for instance secret info query is the signal that makes non-cell like display this
entry asking for the password but it could also send the signal info to show some extra information
on the display now once the user insert the password and press this enter then non-cell is
calling answer query with the password and then if it succeeds GDM is sending verification complete
and a new user session will be started now moving on the other side the pan conversation
so GDM to do a pan conversation it for its pan service that is using is going to spawn
process that is called GDM session process so GDM is communicating with this process
through the private divorce server that created before and in this case the session worker is
exposing a worker interface and GDM is exposing a worker manager interface so usually for the
pan conversation GDM is going to call different methods to start the different stages of a pan
conversation so it would call initialize and authenticate, authorize, establish credentials
and open and at the same time the worker is going to set up a handler to receive the pan messages
so it could receive a message like pan text info which is making the session worker call
the info method which is going to make non-cell and meet the info signal that is going to make
display this extra info text and it could also receive the pan prompt echo off message
that makes the session worker call secret info query that makes GDM send the signal
secret info query in the non-cell site that's the one that is asking for a password and then
was the user and says the password and answer it the password would be return it in this method
and then the pan conversation should go on and succeed or fail
okay thank you John so now let's speak about the current limitations
well the problem the core problem here is that GDM is blind it reads every authentication request
as a text exchange that's fine for username and password but not for other authentication mechanisms
we also have that some pan modules like SSD support different authentication mechanisms
like passkeys or external entity providers and they require a special request one of them is
does the device or a web view well currently GDM doesn't support them
then at on top of that in-bcore organizations you can authenticate yourself through different
methods like smart cards or passkeys but GDM doesn't advertise these mechanisms so the user
is prompted for a mechanism and they need to use this they cannot choose the one that they would
prefer to use in addition some mechanisms are functional but the UX is very limited in the case
of the passkey mechanism well part of the test is not shown on the screen because the level is not
big enough and finally without supporting new methods that require extending the UI it is impossible
to support a serial trust architecture and this is our equivalent for us to support so now I'm
giving back the floor to John that will be a speaker or the solution
so here there was some things that need to be improved so some work has been done to try to
improve this situation so it's been defined a new pen extension message so Pum has a message type
that it's called Pum binary prompt and this is just a stream of bytes so if the Pum module that
is sending message and the handler agree on specific format they can have an extension message
so in this time it's been defined a new extension message that it's called custom JSON which
just allows to send and receive JSON messages so now go in back to the conversation where
the session work is having with GDM then it could receive a message of type Pum binary prompt
and then the worker might parse it and detect that this is an extension message of type
custom JSON and that's making the session worker called the new method called custom JSON
request which is just sending the JSON message to GDM and at the same type GDM is exposing
another interface that is the user verifier custom JSON interface that emits the request signal
so now norm cell has this JSON message that's whatever you have to do and then it's going to
reply with the JSON message yeah like a different JSON message for the reply which would be
return it in the method and then the workflow would be the same and it could see it or fail
so what supports this custom JSON extension message so it's supported by SSSD and LD
to use it with SSSD you would have to use the GDM suitable of Pum service and for LD
there's the GDM of the Pum service now if you use SSSD the JSON message format would be something
like this so the Pum module is going to send a request with the JSON message that is like
saying the authentication mechanisms that are available for a specific user then norm cell
gets that information and does the thing and then answer visualization message which sets the
selected authentication mechanism and the extra parameters required for authenticate and this is
great because in the past we had different Pum services for different authentication mechanisms
and now with one single Pum service we can handle different authentication mechanisms which is great
now this result of these are some UI changes so now the mechanisms are selectable so in the
past you could select your session type now you can also select the mechanism that is supported
by the user that you selected also for a smart authentication the UI has been improved because
the content of the certificates was in 15 properly in the buttons so now the buttons have been
increased and they provide a better UI to display the organization the common name of the certificate
also new pesky mechanism now it supported graphically so I'm not going to explain
about it because a few tags already have expanded very well and also we support the external
identity provider it's called he weblogging so through through a link you access to a website
and you authenticate externally with this identity provider and once you're done you click on
done and the workflow authentication goes on and the last change is the fingerprint it's been
disabled disabled in the login screen and it's only enabled in the login screen and also now
if display a nice icon to inform when the fingerprint sensor is being active and I'll go into try
life demo
well I wasn't expecting this way of seeing the things
but I'm going to try so I have a pesky inserted so I can select the pesky user that has enabled
pesky and then well I'm not sure because from here it's not going to work but well I can insert the
pin and then it's requested me to touch it and succeed and I could throw it no I'm not going to try
nothing else because it worked okay so
so somebody told us this week that this room was curved well we suffered the curse so now regarding the
concussion okay the availability of this feature well we recently released SSD2.12.0 it is available there
and then we are trying to get it into nom if 50 we have two merge requests that are pending review
so we are waiting for some love and feedback there if you have it please go ahead
yeah I'm not looking at anybody here
so regarding the future announcements to this feature so the first one is that we want to add an embedded
web view to the login interface so that the user can authorize the request from the same
system that they want to login in addition the standard pump conversation is very read and we are
thinking that by using a private file the scriptor we can pass complexiation objects
or multi-step challenge responses without hugging the existing pump interface and finally
now that XOR is being removed some of the GDM bits are being moved into system D like starting
stopping the graphical interface or graphical session sorry or doing the authentication well as part
of these changes we are also looking to move all these design into system D so that other
packages like KDE, poll kit or of the can use it and we can have a common interface for all
these software this will probably become a warning but we are still in early stages if you
have any feedback just click on the link and you will be able to see the GitHub discussion
so some reference links here the current SSD GDM interface is available in SSD.i
it's the first link there I also brought a blog post last year for my presentation here where I
explain the enhancements that we are doing through the pump conversation and finally there's a
cover repo that you can use to download the latest updates for SSD, NOMI and other related packages
to make this feature work so some great it's here the first one is to ray a stroke
who has started working on this feature with me he moved to another project and John came to help me
so we would like to thank him and also Marco Trevison or Trevino who is available here in this room
who is doing part of the reviews so thank you very much for joining us here and if you have any
question now this is the right moment to do it
so the question was about if you authenticate with Pascal with Password the Password
the keywing is unlocked and if we authenticate with a different method the keywing might not be unlocked
so how do we handle that and the answer for that is that I don't have experience with the keywing
so I don't have an answer but maybe someone here in the room might know better
the system which creates secrets which are independent of the integration system which is something
we don't know yet we don't have yet we need some kernel world we have lots of stuff after
you need more of that yeah so the answer is for the moment keep it locked but this current work
to find this solution to get it unlocked in different ways
is that something you guys want to do with the question with the spiffy I don't know what
so the first question is about whether the identity provider is external or internal to the
system so the answer is external FAPA supports several different external identity providers
as long as they support of two protocol we can go with them so we use that and it's external
and the other question I didn't get it sorry maybe you can repeat it
increase the attack surface for the login manager so you say if the login manager what does
with the surface it's exposing more attacks I guess I guess so but I don't know about them
when we add the web view at some point we'll need somehow to block some of the requests
because some people might use the system for malicious uses before logging into it so yeah we need
to find a way to block this request that are malicious or that come from people that don't want
to actually log into the system since the main problem here is about integrating the web view
you know a web browser into the login interface first we need to solve that and then we need to
think about how we can block those requests
so the question is whether we use any of these systems when we are at home the answer for me is
no currently I use you know you I have local user so I don't use any of these mechanisms this is
for central human as users but probably soon in several of the organizations where I take part
of we'll move to passwordless because this is our requirement for what for the company I work for
for Red Hat because it's coming from the US government so at some point very soon I hope we'll move to them
but you mentioned if I got it correctly that you removed the fingerprint option from the
as an application of only as a look screen yeah so the the question was we removed the
fingerprint authentication from login screen and it's only enabled in lock screen why and yeah
the answer is because it's using some biometric sometimes it's not like if it's not working
completely fine and sometimes if it's not completely secure for the moment so we've decided to
use it only for the lock screen which other oasis I think use it as well
so I want to kind of reflect on the question about is it making the GDM login less security
we expose external identity provider authentication so there are two ways of using it the one that
was shown on the screen with the QR code so it's no different from the way how you login with
the passport in terms of exposure for the GDM because all you see isn't as a picture right all the
operation happens on the other device that scans this picture and launches their browser so they
suffer meaning your phone is on that tag but it's on that tag anyway if you're forced to use the
identity provider to login when the embedded web view gets there the problem is yes you have to
block certain requests answer from Microsoft developers they failed so they try it and fail
and fail they gain so people will happily watch videos by going to the let's say Google identity
provider and then press and links and go into the main Google site and then select in YouTube and
in during their life without being registered this is one of the examples where a technical solution
might be done but it will fail because there's also an organizational solution that has to be in place
policies exist not because they have to exist because they cover for places and for the
things that technical solutions might not be able to cover completely so it's a combination of
operations in any operating environment where IT organizations work policies exist for a reason so
of course you can spend you can spend years fixing these kind of problems but there will be
people who will get through them sometimes at some point you have to stop and think about maybe
better interfaces and better ways of providing it and in many cases the external IDP is a stop gap
simply because we don't have a better hardware to or availability of a better hardware to do the
passport list authentication things like we're described in the previous talks about using the
NFC or BLA to negotiate communication with the hardware tokens without insert and them and the
USB these are one type of solutions for those so it's in fact it's a huge huge topic but
that goes into a completely non-technical area yeah and I'm taking time from myself
thank you guys
you