Stephen Gallagher wrote:
On 05/24/2010 01:40 AM, David O'Brien wrote:
> I have a few questions about configuring SSSD to use KRB5
> authentication, mostly taken from the man page. I've made lots of
> abbreviations, just leaving in the critical bits. Options with no
> description are there for a reason.
>
> CONFIGURATION OPTIONS
> "If the auth−module krb5 is used in a SSSD domain,..."
> - Is this the same as saying, "If you use Kerberos as your auth
provider"?
>
Yes, this should be more properly expressed as "auth_provider = krb5"
ok, in this case I'd be more inclined to write, "If you use krb5 as the
authentication provider in an SSSD domain,..." (rather than using the
"key=value" format) because the tone of these types of passages is
slightly more conversational. Here I tend to steer away from "if
option=value and bool=true then set x=10". Easy to read and understand
if you deal with it on a daily basis, but I don't think that's the
primary audience of man pages and definitely not user doc.
> "... the following options must be used."
> - Is krb5_kpasswd an exception to this? That is, if the change
> password service *is* running on the KDC, then there is no reason or
> requirement to define alternative servers, right? In the example that I
> have in the user doc (see bottom of page), isn't this defined as follows:
>
This is not a mandatory option. I think we probably want to change that
sentence to "the following options MAY be used". There's actually a fair
amount of changes we probably need to make to the manpages. I'll try to
list the important things below:
Should I wait for the appropriate person to make the required changes to
the man pages (from a technical perspective) so that I can then review
them from an English and readability angle? That will also reduce the
number of times I reproduce errors, etc., in the man pages in the user doc.
Lastly, for all those options with "standard" or "sensible" defaults,
how do I find out what they are?
thanks a lot
> chpass_provider = krb5
> (I'm still getting a handle on this change password provider part)
>
> krb5_kdcip (string)
If left unspecified, DNS service discovery will be used.
> krb5_realm (string)
At present, this is mandatory (correct me if I'm wrong, Jakub). In the
future, it may be possible to detect this by DNS as well.
> krb5_changepw_principal (string)
Has a standard default
> krb5_kpasswd (string)
> If the change password service is not running on the KDC
> alternative servers can be defined here.
That "if" clause is misleading. This option forces the use of a
different kpasswd service from the KDC. If it's not specified, the KDC
is used. It is preferred to always point this at a master kpasswd server
(to avoid propagation-delay errors).
> krb5_ccachedir (string)
Has a sensible default
> krb5_ccname_template (string)
Has a sensible default
> krb5_auth_timeout (integer)
Has a sensible default
> The following three options are included in the man page "must be used"
> list, but do not appear in the example that I currently have in the user
> doc (shown at bottom). Should they be?
None of these are mandatory, as they have defaults.
> krb5_validate (boolean)
> krb5_keytab (string)
> krb5_store_password_if_offline (boolean)
>
> ======
> Current User Doc Example
>
> [domain/KRBDOMAIN]
> enumerate = false
> id_provider = ldap
> chpass_provider = krb5
> ldap_uri =
ldap://ldap.mydomain.org
> ldap_user_search_base = dc=mydomain,dc=org
> tls_reqcert = demand
> ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt
>
> auth_provider = krb5
> krb5_kdcip = 192.168.1.1
> krb5_realm =
EXAMPLE.COM
> krb5_changepw_principal = kadmin/changepw
> krb5_ccachedir = /tmp
> krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX
> krb5_auth_timeout = 15
>
> At this point I'll probably head off home and read the next section in
> my Kerberos book...
>
> cheers
>
--
David O'Brien
Senior Technical Writer, Engineering Content Services
Red Hat Asia Pacific Pty Ltd
193 North Quay, Brisbane
"We couldn't care less about comfort. We make you feel good."
Federico Minoli CEO Ducati Motor S.p.A.