On 05/24/2010 01:40 AM, David O'Brien wrote:
I have a few questions about configuring SSSD to use KRB5
authentication, mostly taken from the man page. I've made lots of
abbreviations, just leaving in the critical bits. Options with no
description are there for a reason.
CONFIGURATION OPTIONS
"If the auth−module krb5 is used in a SSSD domain,..."
- Is this the same as saying, "If you use Kerberos as your auth provider"?
Yes, this should be more properly expressed as "auth_provider = krb5"
"... the following options must be used."
- Is krb5_kpasswd an exception to this? That is, if the change
password service *is* running on the KDC, then there is no reason or
requirement to define alternative servers, right? In the example that I
have in the user doc (see bottom of page), isn't this defined as follows:
This is not a mandatory option. I think we probably want to change that
sentence to "the following options MAY be used". There's actually a fair
amount of changes we probably need to make to the manpages. I'll try to
list the important things below:
chpass_provider = krb5
(I'm still getting a handle on this change password provider part)
krb5_kdcip (string)
If left unspecified, DNS service discovery will be used.
krb5_realm (string)
At present, this is mandatory (correct me
if I'm wrong, Jakub). In the
future, it may be possible to detect this by DNS as well.
krb5_changepw_principal (string)
Has a standard default
krb5_kpasswd (string)
If the change password service is not running on the KDC
alternative servers can be defined here.
That "if" clause is misleading.
This option forces the use of a
different kpasswd service from the KDC. If it's not specified, the KDC
is used. It is preferred to always point this at a master kpasswd server
(to avoid propagation-delay errors).
krb5_ccachedir (string)
Has a sensible default
krb5_ccname_template (string)
Has a sensible default
krb5_auth_timeout (integer)
Has a sensible default
The following three options are included in the man page "must be used"
list, but do not appear in the example that I currently have in the user
doc (shown at bottom). Should they be?
None of these are mandatory, as they have defaults.
krb5_validate (boolean)
krb5_keytab (string)
krb5_store_password_if_offline (boolean)
======
Current User Doc Example
[domain/KRBDOMAIN]
enumerate = false
id_provider = ldap
chpass_provider = krb5
ldap_uri =
ldap://ldap.mydomain.org
ldap_user_search_base = dc=mydomain,dc=org
tls_reqcert = demand
ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt
auth_provider = krb5
krb5_kdcip = 192.168.1.1
krb5_realm =
EXAMPLE.COM
krb5_changepw_principal = kadmin/changepw
krb5_ccachedir = /tmp
krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX
krb5_auth_timeout = 15
At this point I'll probably head off home and read the next section in
my Kerberos book...
cheers
--
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/