Stephen Gallagher schreef op 22.12.2011 13:59:
On Thu, 2011-12-22 at 11:46 +0100, lists wrote:
> >
> >
> > Thanks, I took a closer look and I think (hope) I fixed the
> warnings
> > and
> > errors.
> >
> > There's one 'gotcha' here. I added a nasty hack to the definition
> of
> > sss_krb5_get_init_creds_opt_set_canonicalize() to work around the
> > fact
> > that Heimdal and MIT both define this function with a different
> set
> > of
> > options. For the moment, I'm just adding an extra check so that it
> > will
> > fall back to 'unsupported' until we figure out a way with autoconf
> to
> > check what arguments the function takes.
> >
> > I've attached the new version of the patch and pushed it to my
> > fedorapeople repo as well, on the 'heimdal' branch. You should be
> > able
> > to do a 'git pull' to update it.
>
> Ok, this seems to work. The only change I had to make was to add
> check-ticket-addresses = false to my KDC configuration.
> In the Heimdal based version there is HostAddresses parameter
> present
> that is not there in the MIT based version. (as seen with wireshark)
>
> this is what I tested:
> - getent passwd <ldapuser>
> - ssh <ldapuser>@localhost
> - graphical login (user had a ticket after login)
> all with success.
>
> The communication to openldap was sasl based, so sssd was able to
> get a
> ticket and use it to communicate with openldap.
>
> Do you have other scenarios/things you want me to test?
That's a good start. If possible, I'd like you to test the following
additional features:
1) Password-change (using chpass_provider = krb5)
2) Expiration warning. Set a user principal's password expiration
time
to less than seven days in the future, then perform an online login
at
the console or SSH and verify that you get a warning message that it
will expire soon.
3) Deferred kinit: set 'cache_credentials = True' and
'krb5_store_password_if_offline = True' in sssd.conf and restart
SSSD.
Then perform an offline cached authentication (unplug your network
cable
and log in). Then plug the cable back in. Wait 10-15s and then do a
klist and verify that your credentials were automatically retrieved
once
SSSD detected that you were back online.
Those are the major features I'd like to have tested. Thank you very
much for your help!
Here are my test results;
1) I was not able to change passwords. However I do not think it is
SSSD related.
I was also not able to change passwords via kpasswd. I tried to setup a
completely new realm but even then I could not change a password via
kpasswd.
So either I am doing something wrong or it is a bug in Heimdal.
When changing passwords via SSSD, it sends out the same messages to the
KDC compared to kpasswd.
2) this is working.
3) This is not working.
I am not able to log in when the cable is not connected, only when the
cable is connected.
I get a segfaul message in the /var/log/messages file:
kernel: krb5_child[14373]: segfault at 0 ip 00007f9ad9655471 sp
00007fff8d12f2a8 error 4 in libc-2.13.so[7f9ad95d5000+182000]
I will send sssd logging via pm