Progress call: 17:00 UTC
- Privileged daemon - round 3 (sunil)
- During freedombox upgrade, could be version mismatch between interface and daemon.
- Shutdown privileged daemon after package upgrade.
- On shutdown signal, stop accepting new requests. Only handle existing requests.
- Queued requests will be handled again after new daemon starts up.
- Capturing stdin and stdout to show in logs.
- Database bugs in zoph and miniflux.
- Running functional tests in CI pipeline.
- Fixes some issues in functional tests.
- Other issues in functional tests:
- ejabberd
- backups
- User account creation and authentication
- Backup and restore users
- Replacing current admin account could lead to lockout.
- systemd-homed
- JSON records for user accounts
- Automatically create and encrypt home directory.
- Easy to move home directory to a new system.
- Use this instead of LDAP for authentication.
- All authentication would have to go through system login (PAM).
- Apache config can do PAM lookup instead of LDAP lookup.
- Migrate other apps to OpenID Connect.
FreedomBox service will be an Identity Provider.
- Apps will be Relying Parties.
- Federated login could be possible in the future.
Can eventually remove LDAP from FreedomBox.
- Apps with their own user databases: Can look for authentication plugins.
- Apps will still have user records with preferences, but not passwords.
- Open ID connect is a single-sign on solution where as LDAP is not.
- Python library, Apache module for OpenID Connect
- SAML2 can also be implemented, if needed.
- Keycloak is another option, but not packaged in Debian.
- Heavy resource usage, more geared to enterprise use.
- Time-based one-time passwords
- Backup and restore users
Private FreedomBox without public access
- Apache configuration