On Mon, 2012-07-02 at 10:37 -0400, Stephen Gallagher wrote:
On Wed, 2012-06-27 at 21:51 -0400, Stephen Gallagher wrote:
> These patches add a new provider to SSSD: the AD provider. This provider
> is designed to simplify communication with Active Directory 2008 R2 and
> later. It may work with earlier versions of Active Directory, but we're
> not planning to test or support them.
>
> This set of patches adds the identity, auth and chpass providers. I will
> be providing an access provider as well, but it's not ready and I wanted
> to land these patches sooner rather than later. I also have not added
> any manpages or the SSSDConfig API entries for the new options yet.
> Those are also still forthcoming.
>
> This provider can be configured for testing as follows:
> {{{
> [domain/AD.DOMAIN]
> id_provider = ad
> auth_provider = ad
> chpass_provider = ad
>
> ad_server =
dc1.example.com,
dc2.example.com, _srv_
> ad_domain = AD.DOMAIN
> case_sensitive = False
> }}}
>
> That should be all the configuration needed. The ad_server line can be
> ommitted if SRV records for AD domain controllers exist in DNS. I'm
> working on a way to eliminate the need for 'case_sensitive = False' as
> well, but that's trickier than it sounds because it needs to be set in
> the NSS responder, not just the back-end.
>
> Patches 0001-0005 are minor enhancements to utility.
> Patch 0001: Some logging enhancements for krb5_child
> Patch 0002: KRB5_LOCATOR: Print the filename that couldn't be opened
> Patch 0003: Drop memctx parameter of krb5_try_kdcip and fix a small
> memory leak in the process.
> Patch 0004: Converge the assorted IPA and KRB5 routines for setting up
> the online/offline handlers into a common function that can also be
> reused for the AD provider.
> Patch 0005: Just change the name of the "AD-compatible" schema map for
> the pure LDAP provider so it won't conflict with the one I'm adding to
> the AD provider.
>
>
> The following two patches add the "meat" of the new functionality. Sorry
> for the size of the patches, but I couldn't find a sensible way to break
> them up any further.
>
> Patch 0006: Add AD identity provider
> Patch 0007: Add AD auth and chpass providers
Patches rebased atop the current master (some conflicts resolved with
the recently-pushed SUDO patches).
New patch 0008 attached adds access_provider = ad.
Currently, this has only one function: to perform an expiration/disabled
account check in case the auth phase was skipped (e.g. GSSAPI auth or
SSH pubkey auth).