Il giorno lun, 04/11/2019 alle 08.38 -0500, Neal Gompa ha scritto:
The problem with the Samba team's advice is that it essentially
prevents the MIT Kerberos AD-DC implementation from getting any
better. Without people using it, we can't know what needs to be fixed.
The Red Hat FreeIPA team has been working on making this functionality
work well with MIT Kerberos for nearly a decade. The main reason it's
not in RHEL/CentOS 8 is because the functionality is too new for them
to turn it on.

Also, declaring that it is experimental is meaningless. What defines
it as experimental? Is there any particular known massive breakage?
We're not going to ship Heimdal Kerberos because the two Kerberos
implementations are incompatible and supporting both would be a
massive nightmare.

At this point, the only way Samba Team will stop calling it
experimental is when lots of folks are using it. That's why Fedora
ships with it enabled. We have the opportunity to help make that
better upstream.

After last MIT Kerberos update, another big problem with samba is gone
https://bugzilla.redhat.com/show_bug.cgi?id=1748860#c44

Perhaps the time has come to remove "experimental" from the use of samba + MIT

Or there are yet some other serious reasons not to do it?

Thanks

-- 
Dario Lesca
(inviato dal mio Linux Fedora 31 Workstation)