On Thu, Jun 04, 2015 at 01:15:55PM +0200, Jakub Hrozek wrote:
Hi,
the attached patches implement most of the one-way trust functionality.
The trust directions, fetching keytabs and using different keytabs and
different principals works well for me. I'm still working on changing
the ldap_child to either use ccache collection or using the environment
variables safer, also the failover changes are still missing. But the
feature is testable in my opinion.
There are two NOSUBMIT patches that are useful only for testing until
patches that allow the IPA server principal to read the direction are
available. I hope exposing my super-secret DM password like that is OK,
please change these patches in your testing..
Several patches are not strictly related to one-way trusts, but unify
the info we store for subdomains in IPA and AD or info we store for
subdomains that represent forest root versus member domains.
There are also patches that rename or refactor a bit functions in the
ad_common.c module. I hope this is acceptable, because I had a hard time
le-learning my way around the module. I still think we need to make the
code that selects the appropriate principal from keytab readable better,
currently the setting of "desired_primary" and "default_primary" is
a
total mess.
Most of the code is also unit-tested, so several patches just change
tests.
Here are some points I'd like to get reviewed carefully as I'm not sure
about them myself:
- do we need the SD_TRUST_DIRECTION_NOT_SET enum? I was going back
and forth between having it and just using either a NULL pointer
if the trust direction is uknown or a zero value.
- is the reading of the direction OK? Do we fall back the way we
should?
- are the additional data stored with (sub)domains like forest
stored for forest root subdomains and realm for master domains OK? In
my opinion they make processing of domains easier as there's fewer
special cases..
- should I add a full-blown getter for the forest_root member of
sss_domain_info a a first step towards making the structure
opaque?
Also feel free to propose more tests, either scenarios that I should
test manually or something that should be unit tested.
Hi,
I fixed one casing issue that Sumit found and one similar issue that
Alexander found (and patched, thanks a lot!) and pushed new patches
here:
https://fedorapeople.org/cgit/jhrozek/public_git/sssd.git/log/?h=oneway