Il giorno lun, 04/11/2019 alle 08.38 -0500, Neal Gompa ha scritto:
The problem with the Samba team's advice is that it
essentiallyprevents the MIT Kerberos AD-DC implementation from
getting anybetter. Without people using it, we can't know what needs
to be fixed.The Red Hat FreeIPA team has been working on making this
functionalitywork well with MIT Kerberos for nearly a decade. The
main reason it'snot in RHEL/CentOS 8 is because the functionality is
too new for themto turn it on.
Also, declaring that it is experimental is meaningless. What
definesit as experimental? Is there any particular known massive
breakage?We're not going to ship Heimdal Kerberos because the two
Kerberosimplementations are incompatible and supporting both would be
amassive nightmare.
At this point, the only way Samba Team will stop calling
itexperimental is when lots of folks are using it. That's why
Fedoraships with it enabled. We have the opportunity to help make
thatbetter upstream.
After last MIT Kerberos update, another big problem with samba is gone
https://bugzilla.redhat.com/show_bug.cgi?id=1748860#c44
Perhaps the time has come to remove "experimental" from the use of
samba + MIT
Or there are yet some other serious reasons not to do it?
Thanks
--
Dario Lesca
(inviato dal mio Linux Fedora 31 Workstation)