On Wed, 2011-12-21 at 11:40 +0100, lists wrote:
Stephen Gallagher schreef op 20.12.2011 22:20:
> On Tue, 2011-12-20 at 19:54 +0100, lists wrote:
>> Stephen Gallagher schreef op di 20-12-2011 om 13:42 [-0500]:
>> > On Tue, 2011-12-20 at 19:37 +0100, lists wrote:
>> > > Hi,
>> > >
>> > > Would it be possible to extend SSSD and also support Heimdal as
>> Kerberos
>> > > client implementation?
>> > >
>> > > This patch seems to provide just that:
>> > >
>>
http://cvs.pld-linux.org/cgi-bin/viewvc.cgi/cvs/packages/sssd/sssd-heimda...
>> > >
>> > > My setup is as follows:
>> > > - server with
>> > > - Heimdal KDC
>> > > - openldap
>> > > - pam_ldap / nss_ldap
>> > >
>> > > - laptops/workstations with
>> > > - mit kerberos clients
>> > > - SSSD
>> > >
>> > > I would like to use SSSD on all my machines, but because SSSD
>> does not
>> > > support Heimdal I cannot replace pam_ldap/nss_ldap on the
>> server.
>> > >
>> > > Maybe you could consider this patch and add it to SSSD?
>> >
>> >
>> > Well, this patch as-is won't work (because it disables support for
>> MIT
>> > Kerberos while adding support for Heimdal. We may be able to add
>> support
>> > for choosing the kerberos implementation at build-time.
>> >
>> > It's going to be difficult to test for us, however. Most of our
>> > development is done on Fedora, which has no standalone Heimdal
>> package
>> > (this is because MIT kerberos and Heimdal cannot currently coexist
>> on
>> > the same system because they conflict with some files (like
>> libkrb5.so).
>> >
>> > I can work up a possible patch, but I'd need you to be able to
>> help test
>> > it. Is that something you'd be willing to work on?
>> That would be great. I can help to test it. I will also file an
>> enhancement request.
>
> Ok, I've got a first-pass of the Heimdal compatibility layer. I've
> attached the patch (which applies cleanly on the current master). You
> could also clone my public git repo at
>
git://fedorapeople.org/home/fedora/sgallagh/public_git/sssd.git
> and then 'git checkout heimdal'.
>
> You can then build with 'autoreconf -if && ./configure [appropriate
> distro flags] && make'
>
> (Then finally, 'make install' as root).
I used the git route. My distro is gentoo, and I am using Heimdal
1.4.1.
This is what I used as configure command;
./configure --prefix=/usr --build=x86_64-pc-linux-gnu
--host=x86_64-pc-linux-gnu --mandir=/usr/share/man
--infodir=/usr/share/info --datadir=/usr/share --sysconfdir=/etc
--localstatedir=/var/lib --libdir=/usr/lib64
--disable-dependency-tracking --localstatedir=/var
--enable-nsslibdir=/lib64 --with-plugin-path=/usr/lib64/sssd
--enable-pammoddir=//lib64/security
--with-ldb-lib-dir=/usr/lib64/ldb/modules/ldb --without-nscd
--with-unicode-lib=libunistring --without-selinux --without-semanage
--without-python-bindings --enable-krb5-locator-plugin --enable-nls
--without-libnl
and configure asks me to report this:
....
checking for pcre_compile in -lpcre... yes
checking for krb5-config... /usr/bin/krb5-config
checking for working krb5-config... yes
checking krb5.h usability... yes
checking krb5.h presence... yes
checking for krb5.h... yes
checking krb5/krb5.h usability... no
checking krb5/krb5.h presence... no
checking for krb5/krb5.h... no
checking for krb5_ticket_times... no
checking for krb5_times... yes
checking for krb5_get_init_creds_opt_alloc... yes
checking for krb5_get_error_message... yes
checking for krb5_free_unparsed_name... yes
checking for krb5_get_init_creds_opt_set_expire_callback... no
checking for krb5_get_init_creds_opt_set_fast_ccache_name... no
checking for krb5_get_init_creds_opt_set_fast_flags... no
checking for krb5_get_init_creds_opt_set_canonicalize... yes
checking for krb5_unparse_name_flags... yes
checking for krb5_get_init_creds_opt_set_change_password_prompt... no
checking for krb5_free_keytab_entry_contents... no
checking for krb5_kt_free_entry... yes
checking for krb5_princ_realm... yes
checking for krb5_get_time_offsets... no
checking for krb5_principal_get_realm... yes
checking krb5/locate_plugin.h usability... no
checking krb5/locate_plugin.h presence... yes
configure: WARNING: krb5/locate_plugin.h: present but cannot be
compiled
configure: WARNING: krb5/locate_plugin.h: check for missing
prerequisite headers?
configure: WARNING: krb5/locate_plugin.h: see the Autoconf
documentation
configure: WARNING: krb5/locate_plugin.h: section "Present But
Cannot Be Compiled"
configure: WARNING: krb5/locate_plugin.h: proceeding with the
compiler's result
configure: WARNING: ##
------------------------------------------------ ##
configure: WARNING: ## Report this to
sssd-devel(a)lists.fedorahosted.org ##
configure: WARNING: ##
------------------------------------------------ ##
checking for krb5/locate_plugin.h... no
configure: Kerberos locator plugin cannot be build
checking ares.h usability... yes
This looks like a bug in your Heimdal package. The locator plugin header
can't be compiled. I suggest removing the --enable-krb5-locator-plugin
argument from configure and trying without it.
The locator plugin is there to ensure that non-SSSD kerberized
applications will always talk to the same KDC/kadmin server that SSSD is
currently using. Without it, you need to make sure that krb5.conf is
configured correctly. Then your kerberized apps will EACH make their own
decision as to which KDC to talk to (rather than asking SSSD which one
to use).