On Fri, Jul 31, 2015 at 11:34:23AM +0200, Sumit Bose wrote:
> Hi,
>
> it turned out that some of the current SSSD behaviour does not fit well
> if a KDC proxy is configured, see
>
https://fedorahosted.org/sssd/ticket/2652 and
>
https://fedorahosted.org/sssd/ticket/2700 for details.
>
> The first patch in this series introduces a new call which checks if a
> KDC proxy is configured as suggested in the tickets. The other two
> patches aim to fix the respective ticket.
>
> bye,
> Sumit
Please find attached a new version of the patches. They fix a memory
leak found by Christian in the first patch and contain a different
version of the third patch because the original version didn't fix the
issue Alexander was seeing. There is only a minor change compared to the
version Alexander tested, krb5.conf is not checked unconditionally but
only if the state is offline.
There was another comment by Christian on irc. Currently the patches
only check the kdc config entry. In theory if would be possible that for
the kdc a direct connection is used while the admin_server is configured
via a proxy. Since this is expected to be an un-common configuration I
hope it can be added later. To solve this I think
sss_krb5_realm_has_proxy() should get a second option indication if kdc
or admin_server should be checked. Depending on the type of request,
(pre-)auth or change password, or info file, kdcinfo or kpasswdinfo,
sss_krb5_realm_has_proxy() should be called with the matching option.
sss_krb5_realm_has_proxy() looks good to me. IMHO it's fine to just
check kdc for https for now.
Christian