Hi Martin,

1)      pam_gss requires the newest krb5-devel you can dig up in the repository (I’ve not had any issues compiling it here), and on the system where you are using it, you need: krb5-libs, krb5-server and krb5-workstation v1.10.3-10.el6_4.6 (that’s what I have here, and pam_gss functions ok).

One thing to note... I have not been able to make pam_gss work with SSH (i.e. in the SSH PAM stack) – the password never makes it through (or is sent through garbled/encoded, I don’t know which). Of course, any progress anyone here makes in that regard will be helpful.

2)      Is the OpenSSH you’re using the version in the repository? Check that you disable PasswordAuthentication and enable all four GSSAPI* options on the Moonshot version of sshd_config, then enable GSSAPIKeyExchange and GSSAPIAuthentication in ssh_config. Since you’re SSH’ing into the localhost, you already have Moonshot installed...

For both, make sure that the attribute-map.xml file in /etc/shibboleth maps one of the OIDs in your SAML-AAA-Assertion to local-login-user. Be careful about your choice because Shibboleth will use attribute-policy.xml to filter out attributes that do not conform to the policy in that file (some attributes are ‘scoped’, which, if they don’t match the scoping rule, will be removed).

:-)

Stefan