Red Hat Security: Identity Management and Authentication

The System Security Services Daemon (SSSD) caches information about objects such as users, groups, sudo rules, and SSH keys.

The Pluggable Authentication Module (PAM) system works by stacking various authentication modules into sets, and applying those sets to the auth, account, password, and session management groups.

Each PAM management group can apply the modules in the stack with several levels of control: required, requisite, sufficient, or optional.

Kerberos is an authentication system that enables principals that trust a third party to then trust each other.

Kerberos principals can be users, hosts, or services that are involved in authentication.

Keytab files are passwordless principal credentials, and enable nonhuman actors, such as hosts and services, to participate in Kerberos authentication.

A public key infrastructure consists of a root certificate authority and optionally one or more intermediate authorities, which sign end-entity certificates for individual services.

A wildcard certificate (*.example.com) can be used by any service within the domain, but it adds risk to an infrastructure.