On Tue, 13 Sep 2011 17:07:28 -0400 Russell Bryant rbryant@redhat.com wrote:
On 09/13/2011 04:57 PM, Adam Stokes wrote:
- Verify k5start exists
- Run k5start and check the top most principal (without this we would need to probably do some regexing through the klist to attempt to find which principal we want)
- This will re-initialization *existing* kerberos tickets without need for password.
- Actually show none connection options as a result of more
kerberos work
Signed-off-by: Adam Stokesastokes@fedoraproject.org
src/lib/mh_agent.cpp | 27 +++++++++++++++++++++++++-- 1 files changed, 25 insertions(+), 2 deletions(-)
diff --git a/src/lib/mh_agent.cpp b/src/lib/mh_agent.cpp index bb1a9b6..00cafda 100644 --- a/src/lib/mh_agent.cpp +++ b/src/lib/mh_agent.cpp @@ -232,8 +232,7 @@ int print_help(int code, const char *name, const char *arg, void *userdata) printf("\nOptions:\n"); printf("\t-h | --help print this help message.\n"); for (lpc = 0; lpc< DIMOF(matahari_options); lpc++) {
if (matahari_options[lpc].callback
-&& matahari_options[lpc].callback != connection_option) {
if (matahari_options[lpc].callback) { printf("\t-%c | --%-10s\t%s\n",
matahari_options[lpc].code, matahari_options[lpc].long_name, matahari_options[lpc].description); }
I agree with this change. The old code was obviously very intentional, but I don't know why.
beekhof: do you remember why the connection options were suppressed from the help output?
@@ -249,6 +248,16 @@ mh_connect(OptionsMap mh_options, OptionsMap amqp_options, int retry) int backoff = 0; GList *srv_records = NULL, *cur_srv_record = NULL; struct mh_dnssrv_record *record;
- GError *error = NULL;
- gboolean ret;
- const gchar *k5start_bin[] = {
"/usr/bin/k5start",
"-f",
"/etc/krb5.keytab",
"-K",
"10",
"-U",
- };
I'm pretty sure here has to be a NULL terminator in this array.
Yep, always forget the damn NULL :\
if (!mh_options.count("servername") ||
mh_options.count("dns-srv")) { /* @@ -320,6 +329,20 @@ mh_connect(OptionsMap mh_options, OptionsMap amqp_options, int retry) } } }
- /* Attempt to initiate k5start for credential renewal's
without prompting for a
* password each time an agent is run
*/
- if (mh_options.count("sasl-mechanism")) {
Are there any other uses of sasl-mechanism that are not kerberos?
Link to implementations for cyrus-sasl
http://asg.web.cmu.edu/sasl/sasl-library.html This is the Cyrus SASL API implentation. It can be used on the client or server side to provide authentication. See RFC 2222 for more information.
The following "core" mechanisms are included in this distribution:
ANONYMOUS CRAM-MD5 PLAIN GSSAPI (MIT Kerberos 5 or Heimdal Kerberos 5) DIGEST-MD5
The distribution also includes these mechanisms:
LOGIN SRP NTLM OTP KERBEROS_V4
As far as the core mechanisms go gssapi is really the only major one we worry about.
if (g_file_test(k5start_bin[0],
G_FILE_TEST_IS_EXECUTABLE)) {
mh_info("Running k5start");
mh_trace() ?
Will fix.
ret = g_spawn_async(NULL, (gchar **) k5start_bin,
NULL, G_SPAWN_SEARCH_PATH,
NULL, NULL, NULL,&error);
Just make the array non-const so you don't have to cast.
Then I get string warning in c++ :\
Also, this will result in every agent running k5start. Is that a problem?
Shouldn't be.