On Tue, 2011-12-20 at 19:54 +0100, lists wrote:
Stephen Gallagher schreef op di 20-12-2011 om 13:42 [-0500]:
> On Tue, 2011-12-20 at 19:37 +0100, lists wrote:
> > Hi,
> >
> > Would it be possible to extend SSSD and also support Heimdal as Kerberos
> > client implementation?
> >
> > This patch seems to provide just that:
> >
http://cvs.pld-linux.org/cgi-bin/viewvc.cgi/cvs/packages/sssd/sssd-heimda...
> >
> > My setup is as follows:
> > - server with
> > - Heimdal KDC
> > - openldap
> > - pam_ldap / nss_ldap
> >
> > - laptops/workstations with
> > - mit kerberos clients
> > - SSSD
> >
> > I would like to use SSSD on all my machines, but because SSSD does not
> > support Heimdal I cannot replace pam_ldap/nss_ldap on the server.
> >
> > Maybe you could consider this patch and add it to SSSD?
>
>
> Well, this patch as-is won't work (because it disables support for MIT
> Kerberos while adding support for Heimdal. We may be able to add support
> for choosing the kerberos implementation at build-time.
>
> It's going to be difficult to test for us, however. Most of our
> development is done on Fedora, which has no standalone Heimdal package
> (this is because MIT kerberos and Heimdal cannot currently coexist on
> the same system because they conflict with some files (like libkrb5.so).
>
> I can work up a possible patch, but I'd need you to be able to help test
> it. Is that something you'd be willing to work on?
That would be great. I can help to test it. I will also file an
enhancement request.
Ok, I've got a first-pass of the Heimdal compatibility layer. I've
attached the patch (which applies cleanly on the current master). You
could also clone my public git repo at
git://fedorapeople.org/home/fedora/sgallagh/public_git/sssd.git
and then 'git checkout heimdal'.
You can then build with 'autoreconf -if && ./configure [appropriate
distro flags] && make'
(Then finally, 'make install' as root).