On 11/21/2011 02:12 PM, Stephen Gallagher wrote:
The problem with having this updated on-the-fly is that it implies (by necessity) that client applications have to have privilege to change this at whim. That means that this information cannot be used as authoritative (since the client could very possibly be lying about this). I think it's probably better to rely on setting it at join time with 'net ads' and then only allow it to be changed by an administrator later.
I do not understand. Not all applications have access, only those which have access to the system Kerberos database (krb5.keytab). Typically, only root (like sssd) applications have such an access and I can not imagine why would sssd lie about this....
Can you clarify?
Ondrej