On 02/10/2012 05:25 AM, Sumit Bose wrote:
Currently sssd tries to determine the principal from an LDAP entry (see
ldap_user_principal config option) or if not found guesses it by adding
the realm to the user name. Using .k5login to determine the principal is
currently not implemented and I think it might not be the best idea to
use .k5login for this e.g. because .k5login can contain multiple names.
I think it would be better to have something like .k5principal to hold
the principal, although I have to think more carefully about the
security implication allowing the user to set his principal.
Much Thanks!! This is working for me now with this setup:
dn: uid=testman,ou=People,dc=test,dc=phy,dc=duke,dc=edu
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: krbPrincipalAux
krbPrincipalName: jdorff(a)XXX.DUKE.EDU
uid: testman
cn: Test Account
gecos: Test Account
uidNumber: 1500
gidNumber: 1500
loginShell: /bin/bash
homeDirectory: /home/testman
I agree it's much cleaner to have this stored in LDAP vs yet another dot
file.
Cheers,
Jimmy