URL:
https://github.com/SSSD/sssd/pull/5647
Title: #5647: krb5_child: Honor Kerberos keytab location
sumit-bose commented:
"""
Hi,
thank you for the new version, this is a valid solution. However I would like to ask you
for another change. I wonder if you can just add an empty string `create_send_buffer()` in
case the keytab is not set, similar to `create_tgt_req_send_buffer()`
(
https://github.com/SSSD/sssd/blob/master/src/providers/ldap/sdap_child_he... and
https://github.com/SSSD/sssd/blob/master/src/providers/ldap/sdap_child_he...).
And then call `krb5_kt_default()` or `krb5_kt_default_name()` only in `krb5_child`.
One of reasons I'm asking is to be similar to how it is handled in the LDAP provider
and `ldap_child`. `ldap_child` does very similar things as `krb5_child` and it might be
worth to consider to move the functionality of `ldap_child` to `krb5_child` eventually to
reduce code duplication. For this it would be good to do the keytab handling in the same
way.
Another reason is to try to move as much libkrb5 call into `krb5_child` so that eventually
it might be possible to not link the krb5 backend code with libkrb5 and have only
`krb5_child` depending on libkrb5. I'm not sure if the is really possible, but at
least here with getting the default keytab it would be easy to achieve.
bye,
Sumit
"""
See the full comment at
https://github.com/SSSD/sssd/pull/5647#issuecomment-851335285