----- Original Message -----
On 09/22/2013 09:06 PM, Jakub Hrozek wrote:
> Hi,
>
> I was playing with different offline krb5 authentication ways today when
> testing Sumit's patches and I don't think the offline authentication of
> subdomain users was correct. Attached are two patches -- one is just a
> better error code, the other actually makes the SSSD search for the
> right user entry during krb5 offline auth.
>
> To test the first one, pause of shutdown a trusted AD while remaining
> connected to the root domain AD.
Ack.
You could also use state->sysdb directly and be consistent with rest of
the code in krb5_auth.c but...
We should decide whether to use state->domain->sysdb or state->sysdb and
be always consistent in future development. I'd prefer the first one,
since sysdb is very much bounded to a domain (now with subdomains more
than ever) and it makes it clear.
+1
Not too long ago I went through a very painful set of patches to resolve similar kind of
issues all over the code, please do not reintroduce inconsistencies, we do not want to go
through and refactor all the code again in a few months.
Simo.
--
Simo Sorce * Red Hat, Inc. * New York