Ah, yes i do use kerberized NFS, and i also want to use sasl gssapi to
authenticate the sssd.
My understanding was that i needed upn=nfs/* to get nfsv4 krb, however
with your patch
(i applied it on nfs-utils-1.2.2-4.el6.x86_64) i dont need upn=nfs/*
anymore as you say. Although
i do need upn=host/*, but maybe that's how it supporse to be ? My
knowledge to kerberos and
AD is very limited unfortunately so when discussing this I'm on very
thin ice.
Now with that nfs-utils-patch applied, and sssd 1.3 i got both sssd and
nfsv4 working with upn=host/*.
Maybe a similar approach could be used with sssd, so there would be
no
need to specify the authid (which is different for every hostname)?
I think it do use that approach, however it gives you the possibility to
change your authid if want to, that's
how i understand anyways.
Again, maybe this is not the correct mailinglist for this discussion.
Btw,. if your patch is correct why isn't it accepted upstreams ?
Best regards,
Patrik Martinsson, Sweden.
On 08/05/2010 05:25 PM, Timo Aaltonen wrote:
On Thu, 5 Aug 2010, Patrik Martinsson wrote:
> Hey,
>
> I got this working today with these settings,
>
> ldap_uri = ldap://foo.bar
> ldap_sasl_mech = gssapi
> ldap_krb5_keytab = /etc/krb5.keytab
> ldap_sasl_authid = nfs/xx.xxxx.xx
>
....
<snip>
Looks like you need kerberized NFS? See this patch that I made for
nfs-utils:
http://users.tkk.fi/~tjaalton/0001-Check-for-AD-style-machine-principal-n...
still not accepted upstream, but I'm hoping for the best. With this you
don't need to add "nfs/*" UPN:s, gssd will initialize and use HOSTNAME$
just fine.
Maybe a similar approach could be used with sssd, so there would be no
need to specify the authid (which is different for every hostname)?
ps. still fighting with the installation.. so can't test the above and
post logs just yet. Tomorrow, I promise :)