Hi,
this is an attempt to fix bz#571896 aka trac#415. A new parameter krb5_kadmin is introduced together with a new failover service in the Kerberos provider. If the change password service is not available the backend is not switched to offline mode unless authentication isn't possible too.
I haven't add to option to the IPA provider, because I think here the kpasswd always runs together with the KDC.
bye, Sumit
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 03/10/2010 11:18 AM, Sumit Bose wrote:
Hi,
this is an attempt to fix bz#571896 aka trac#415. A new parameter krb5_kadmin is introduced together with a new failover service in the Kerberos provider. If the change password service is not available the backend is not switched to offline mode unless authentication isn't possible too.
I haven't add to option to the IPA provider, because I think here the kpasswd always runs together with the KDC.
bye, Sumit
To sum up a conversation we had on IRC yesterday:
Nack, please use krb5_kpasswd instead of krb5_kadmin.
Additionally, this patch brought to mind that we need to handle non-standard ports for both krb5_kdcip and krb5_kpasswd.
- -- Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/
On Thu, Mar 11, 2010 at 07:19:13AM -0500, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 03/10/2010 11:18 AM, Sumit Bose wrote:
Hi,
this is an attempt to fix bz#571896 aka trac#415. A new parameter krb5_kadmin is introduced together with a new failover service in the Kerberos provider. If the change password service is not available the backend is not switched to offline mode unless authentication isn't possible too.
I haven't add to option to the IPA provider, because I think here the kpasswd always runs together with the KDC.
bye, Sumit
To sum up a conversation we had on IRC yesterday:
Nack, please use krb5_kpasswd instead of krb5_kadmin.
Additionally, this patch brought to mind that we need to handle non-standard ports for both krb5_kdcip and krb5_kpasswd.
new version attached.
bye, Sumit
Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEUEARECAAYFAkuY38EACgkQeiVVYja6o6N98gCfR3Kjk0OlFHq9bHLJMVgJD8Vy ZbkAmIYbb3T1Cjl80YQEjTfTRJtXe1w= =+ZZP -----END PGP SIGNATURE----- _______________________________________________ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 03/11/2010 10:05 AM, Sumit Bose wrote:
On Thu, Mar 11, 2010 at 07:19:13AM -0500, Stephen Gallagher wrote: On 03/10/2010 11:18 AM, Sumit Bose wrote:
Hi,
this is an attempt to fix bz#571896 aka trac#415. A new parameter krb5_kadmin is introduced together with a new failover service in the Kerberos provider. If the change password service is not available the backend is not switched to offline mode unless authentication isn't possible too.
I haven't add to option to the IPA provider, because I think here the kpasswd always runs together with the KDC.
bye, Sumit
To sum up a conversation we had on IRC yesterday:
Nack, please use krb5_kpasswd instead of krb5_kadmin.
Additionally, this patch brought to mind that we need to handle non-standard ports for both krb5_kdcip and krb5_kpasswd.
new version attached.
bye, Sumit
Nack (nitpicks).
Using strtol() to assign a value to an int (rather than a long) can be unsafe, as on some platforms int == short.
I'd rather you used a uint16_t for the sssd_ctx->kdc_port and sssd_ctx->kpasswd_port. That's the only acceptable range in any case.
Same for the port in the sssd_krb5_locator_lookup(). And other places.
Otherwise, the code looks sound to me.
- -- Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/
On Thu, Mar 11, 2010 at 11:00:58AM -0500, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 03/11/2010 10:05 AM, Sumit Bose wrote:
On Thu, Mar 11, 2010 at 07:19:13AM -0500, Stephen Gallagher wrote: On 03/10/2010 11:18 AM, Sumit Bose wrote:
Hi,
this is an attempt to fix bz#571896 aka trac#415. A new parameter krb5_kadmin is introduced together with a new failover service in the Kerberos provider. If the change password service is not available the backend is not switched to offline mode unless authentication isn't possible too.
I haven't add to option to the IPA provider, because I think here the kpasswd always runs together with the KDC.
bye, Sumit
To sum up a conversation we had on IRC yesterday:
Nack, please use krb5_kpasswd instead of krb5_kadmin.
Additionally, this patch brought to mind that we need to handle non-standard ports for both krb5_kdcip and krb5_kpasswd.
new version attached.
bye, Sumit
Nack (nitpicks).
Using strtol() to assign a value to an int (rather than a long) can be unsafe, as on some platforms int == short.
I'd rather you used a uint16_t for the sssd_ctx->kdc_port and sssd_ctx->kpasswd_port. That's the only acceptable range in any case.
Same for the port in the sssd_krb5_locator_lookup(). And other places.
Otherwise, the code looks sound to me.
please find attached the new version.
bye, Sumit
Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkuZE7oACgkQeiVVYja6o6OT3wCdEVRiDXbj+K3jXvAwp0fAaJhc xAUAoJ2GwOMAWIrMOnnfyNJRTV4/dg+A =2uDl -----END PGP SIGNATURE----- _______________________________________________ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 03/11/2010 03:31 PM, Sumit Bose wrote
please find attached the new version.
bye, Sumit
Ack. Excellent work, Sumit.
- -- Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 03/12/2010 07:35 AM, Stephen Gallagher wrote:
On 03/11/2010 03:31 PM, Sumit Bose wrote
please find attached the new version.
bye, Sumit
Ack. Excellent work, Sumit.
Pushed to master and 1-1-0
- -- Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/
sssd-devel@lists.fedorahosted.org