I have a few questions about configuring SSSD to use KRB5
authentication, mostly taken from the man page. I've made lots of
abbreviations, just leaving in the critical bits. Options with no
description are there for a reason.
CONFIGURATION OPTIONS
"If the auth−module krb5 is used in a SSSD domain,..."
- Is this the same as saying, "If you use Kerberos as your auth provider"?
"... the following options must be used."
- Is krb5_kpasswd an exception to this? That is, if the change
password service *is* running on the KDC, then there is no reason or
requirement to define alternative servers, right? In the example that I
have in the user doc (see bottom of page), isn't this defined as follows:
chpass_provider = krb5
(I'm still getting a handle on this change password provider part)
krb5_kdcip (string)
krb5_realm (string)
krb5_changepw_principal (string)
krb5_kpasswd (string)
If the change password service is not running on the KDC
alternative servers can be defined here.
krb5_ccachedir (string)
krb5_ccname_template (string)
krb5_auth_timeout (integer)
The following three options are included in the man page "must be used"
list, but do not appear in the example that I currently have in the user
doc (shown at bottom). Should they be?
krb5_validate (boolean)
krb5_keytab (string)
krb5_store_password_if_offline (boolean)
======
Current User Doc Example
[domain/KRBDOMAIN]
enumerate = false
id_provider = ldap
chpass_provider = krb5
ldap_uri =
ldap://ldap.mydomain.org
ldap_user_search_base = dc=mydomain,dc=org
tls_reqcert = demand
ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt
auth_provider = krb5
krb5_kdcip = 192.168.1.1
krb5_realm =
EXAMPLE.COM
krb5_changepw_principal = kadmin/changepw
krb5_ccachedir = /tmp
krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX
krb5_auth_timeout = 15
At this point I'll probably head off home and read the next section in
my Kerberos book...
cheers
--
David O'Brien
Senior Technical Writer, Engineering Content Services
Red Hat Asia Pacific Pty Ltd
193 North Quay, Brisbane
"We couldn't care less about comfort. We make you feel good."
Federico Minoli CEO Ducati Motor S.p.A.