Hi,
this patch set should fix
https://fedorahosted.org/sssd/ticket/2958
"Support multiple principals for IPA users" so the IPA users can log in
with their Kerberos alias as well.
The overall code-path was already added for the UPN feature but had to
be extended at various places. The main difference is that the realm
part of the AD UPNs with an alternative domain suffix do not related to
a known domain name. The realm part from the Kerberos aliases can come
from any domain. The same is true for email addresses which are supported
by this patch set as well.
I know that Jakub had some concerns adding email addresses now and the
another attribute in the next version and so on. I would like to make
this scheme more generic so that the attributes which should be used for
login names can be configured. Unfortunately I didn't had the time do
already do it in this patch-set.
Adding a larger number of sources for the login name increases the
chance for collisions. But since each of the name types, Kerberos
principals and email addresses, are expected to be unique in their
domain, I hope the chances are still low enough.
bye,
Sumit