Workload Identity: Add support for BOT accounts - #9104
Draft
pbrezina wants to merge 8 commits into
Draft
Conversation
Switch to enable bot accounts lookup. :config: A new configuration option `bot_accounts_enabled` to enable bot accounts lookup for the domain.
The bot account name has uid encoded in the name, we extract the uid and proceed with user-by-id lookup. The information that a bot account was resolved is stored inside struct cache_req_result. This commit adds a support for all domains without the possibility to override it. The logic that switching cache_req lookup type has to be moved to the inner parts of cache_req in order to support per-domain option do enable/disable this feature. However, I'm leaving this commit as well to showcase the idea and make the review little bit easier.
The bot accounts can be enabled or disabled with per-domain configuration option. If the name looks like a bot account and the domain enables it, the cache_req will switch to by-uid lookups.
Bot accounts shares the same uid as the user on behalf which they act, storing them in memcache would corrupt it.
If a bot account was resolved, we want to keep the uid and gid, but override the name and shell so the bot name can then be passed by ssh to pam, and so ssh can invoke our confined shell.
pbrezina
force-pushed
the
workload-identity
branch
from
August 20, 2026 09:54
54fd320 to
e156e9e
Compare
pbrezina
force-pushed
the
workload-identity
branch
from
August 20, 2026 09:59
e156e9e to
070cab2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull requests implements changes described at:
It adds per-domain support for special, ephemeral, bot accoutns to represent a workload identity that acts on behalf of a user. The idea is that and MCP server exchanges a user's OAuth2 token for an S4U2Proxy Kerberos ticket to access a Kerberized service (we target SSH specifically for the use case, but any service can be used), The ticket, however, is not issued for the real user but for an ephemeral BOT principal, including MCP server's and request's metadata in the ticket. SSSD is able to resolve the BOT account into the user account, keeping uid and gid but overriding username and shell (for logging purposes and for executing commands via ssh inside our own shell). The shell will be able to log the actions and filter the commands based on the ticket scope and configuration.
This PR is in draft mode, but I would like it to get reviewed continuously as I deliver individual pieces.
Currently implemented:
[x] nss is able to resolve bot accounts
[] support bot accounts in in-memory cache for a quick lookup in nss_sss.so
[] add support to kerberos localname plugin
[] read metadata from kerberos ticket and pass it to pam
[] pass metadata from pam to the overriden shell
[] implement kerberos plugins to automatically attach metadata to new tickets obtained on the ssh host
[] IPA part