On Tue, Jan 19, 2016 at 04:55:54PM +0100, Jakub Hrozek wrote:
> On Tue, Jan 19, 2016 at 03:15:01PM +0100, Sumit Bose wrote:
> > On Mon, Jan 18, 2016 at 04:48:40PM +0100, Jakub Hrozek wrote:
> > > On Mon, Jan 18, 2016 at 01:53:27PM +0100, Sumit Bose wrote:
> > > > Thank you for the review. New version attached.
> > > >
> > > > bye,
> > > > Sumit
> > >
> > > Thank you, the patch now look good to me and seem to work well. I see
> > > this message in adcli output:
> > > ! Couldn't set userAccountControl on computer account:
CN=ADCLIENT,CN=Computers,DC=win,DC=trust,DC=test: Insufficient access
> >
> > yes, this is expected. adcli can update other attributes as well, but in
> > general the permissions the host princiapal has are not sufficient.
> >
> > >
> > > but the keytab was updated successfully.
> > >
> > > I also wonder if you considered using the -S option to run the update
> > > against the server sssd talks to? From experience I know that many
> > > environments restrict access to parts of their AD domain. It's not a
big
> > > deal, though, because failing to renew the keytab is non-fatal..
> >
> > That's a good idea. I added three new patches on top of the existing
> > ones to add this. I used the failover code to get the active server
> > because I found this more accessible here compared to getting the LDAP
> > connection internals to call getpeername(). If you don't like it I think
> > I would prefer to just commit the initial 3 patches and create a ticket
> > to add -S support.
> >
> > bye,
> > Sumit
>
> Thank you, the patches seem to work well. I tested by assigning a client
> to a site, then the LDAP lookups as well as the keytab renewal
> communicated with the DC in site. Then I hardcoded a DC with 'ad_server'
> and the communication was always directed to the hardcoded DC.
>
> ACK
>
> I will just run Coverity and CI before pushing to be sure..
CI passed:
http://sssd-ci.duckdns.org/logs/job/35/76/summary.html
* master:
* 8167761a1e1d7575d49babcea45937fc9cd45fdc
* 7fdec78178440855058be8ca1011e0b1aa45de31
* 5a7f17aedad34a8618765bc33342c109a6958ab5
* 5f7cd30c865046a7ea69944f7e07c85b4c43465a
* e89c2cb5ec77d57ed93952dae08df51738834faf
* 9dcc7dbf04466cd8cd90aa0bb8acbebef9aca832
* sssd-1-13:
* 95024cd9a24164cbaf6704aace93e1592edd9733
* 11271254205e9f7c1caf363be8822b3f9756f061
* d4844683cbbb6e366afd56e7753adb79c20e93a5
* 20ed1a2063e0463c9e97870ea4e5e607467b041e
* 375772251671797fa7ffe47491e7f8a9ac35aa72
* 831883be77a2c60a44df99798bf4091bf450adb2
Please do not forget to commit your patch with tests for extra_args_only
option. I already ACKed it earlier in this thread.
bye,
Sumit
> _______________________________________________
> sssd-devel mailing list
> sssd-devel(a)lists.fedorahosted.org
>