URL:
https://github.com/SSSD/sssd/pull/5486
Title: #5486: krb5: allow to use subdomain realm during authentication
mastersin commented:
"""
I rewrite code and don't modify krb5_ctx now.
More details for my use-case:
* We have special migration process to using SambaDC as domain controller:
* original domain on WindowsDC
* Samba domain with 2way trusts to original domain
* Linux clients joins to Samba domain
* original domain users logins via sssd on Linux clients
* For original domain users with upnSuffixes we have a problem:
* Samba KDC don't support authentication with enterprise upns fully due it don't
know about upnSuffixes in trusted domain
* So, instead of answer WRONG REALM it reverts "not found in Kerberos
database"
* Solution for this serverside problem on client for users from trusted domain is not
using WindowsDC indirectly (via libkrb5 process for enterprise user principal names) by
Samba KDC, but send kerberos requests to WindowsDC directly
Option krb5_use_subdomain_realm allows to krb5 provider use subdomain realm for kerberos
requests to trusted domain KDC directly.
"""
See the full comment at
https://github.com/SSSD/sssd/pull/5486#issuecomment-771635250