On Thu, Nov 05, 2015 at 01:02:07PM +0100, Lukas Slebodnik wrote:
On (05/11/15 12:42), Sumit Bose wrote:
>On Thu, Nov 05, 2015 at 12:12:17PM +0100, Lukas Slebodnik wrote:
>> ehlo,
>>
>> attached simple patch is a result of "Fedora end of life"
>> message for related Fedora ticket.
>>
>> If you have an idea about better names I will be glad to change them.
>>
>> BTW shoulw we also remove this part from function
>> sss_write_krb5_conf_snippet
>>
>> LS
>
>> From c4d56af303ba4385cf9ef1c9053545c243f07a44 Mon Sep 17 00:00:00 2001
>> From: Lukas Slebodnik <lslebodn(a)redhat.com>
>> Date: Thu, 5 Nov 2015 11:08:36 +0100
>> Subject: [PATCH] BUILD: Enable the sssd krb5 localauth plugin by default
>>
>> It will be installed to /etc/krb.conf.d/ only on these
>> platforms which has krb5 with this directory
>>
>> Resolves:
>>
https://fedorahosted.org/sssd/ticket/2449
>
>...
>
>
>> new file mode 100644
>> index
0000000000000000000000000000000000000000..950cab8200eb50d7fc878723d38c93d5b616e468
>> --- /dev/null
>> +++ b/src/examples/sssd_localauth.conf.in
>> @@ -0,0 +1,5 @@
>> +[plugins]
>> + localauth = {
>> + module = sssd:@krb5localauth_plugindir@/sssd_krb5_localauth_plugin.so
>> + enable_only = sssd
>> + }
>
>just a comment, I think enable_only should not be used here. I added it
>originally becasue I thought no other modules would be needed anymore,
>but I was wrong, see e.g.
https://fedorahosted.org/sssd/ticket/2788 or
>https://fedorahosted.org/sssd/ticket/2707.
>
I inspired in /var/lib/sss/pubconf/krb5.include.d/localauth_plugin
I removed the option enable_only.
Will it solve #2707 and #2788?
or it is unrelated.
It depends. If e.g. the AD and IPA providers would not create
/var/lib/sss/pubconf/krb5.include.d/localauth_plugin anymore if
/etc/krb5.conf.d/sssd_localauth.conf exists I think #2788 is fixed
because we would fall back to the builtin k5login check if enable_only
is not set in /etc/krb5.conf.d/sssd_localauth.conf. If both files exists
and there is a 'includedir /var/lib/sss/pubconf/krb5.include.d/' in
/etc/krb5.conf it depends which file is processed first so I think we
should try to avoid it.
Btw, what about the domain_realm mapping files we create in
/var/lib/sss/pubconf/krb5.include.d/localauth_plugin ? Should they be
created in /etc/krb5.conf.d/ if the directory exists? (Must not be
solved in the context of this ticket).
If the file is labeled as '%config(noreplace)' in the spec
file we could say that the list is now configurable because changes stay
and close #2707 as well.
bye,
Sumit
LS