On Fri, 6 Aug 2010, Patrik Martinsson wrote:
Ah, yes i do use kerberized NFS, and i also want to use sasl gssapi
to
authenticate the sssd.
My understanding was that i needed upn=nfs/* to get nfsv4 krb, however
with your patch (i applied it on nfs-utils-1.2.2-4.el6.x86_64) i dont
need upn=nfs/* anymore as you say. Although i do need upn=host/*, but
maybe that's how it supporse to be ? My knowledge to kerberos and AD is
very limited unfortunately so when discussing this I'm on very thin ice.
No, with the patch you don't need to use 'upn=...' at all, gssd would then
use the default HOST$ principalname.
though the problem with sssd remains. Maybe I should begin using
'upn=host/..' too..
Now with that nfs-utils-patch applied, and sssd 1.3 i got both sssd
and
nfsv4 working with upn=host/*.
> Maybe a similar approach could be used with sssd, so there would be no
> need to specify the authid (which is different for every hostname)?
I think it do use that approach, however it gives you the possibility to
change your authid if want to, that's
how i understand anyways.
Again, maybe this is not the correct mailinglist for this discussion.
Btw,. if your patch is correct why isn't it accepted upstreams ?
It's making an already complicated function more unreadable, so it needs
to be cleaned up first and then add a revised patch on top.
--
Timo Aaltonen
Systems Specialist, Aalto IT