Hi,
this patch to the sssd-krb5 man page should clarify how the krb5 provider will find the right UPN.
This hopefully fixes #204.
Please fell free to correct any grammar or spelling mistakes.
bye, Sumit
Sumit Bose wrote:
Hi,
this patch to the sssd-krb5 man page should clarify how the krb5 provider will find the right UPN.
This hopefully fixes #204.
Please fell free to correct any grammar or spelling mistakes.
bye, Sumit
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel
<snip>
<term>krb5try_simple_upn (boolean)</term> <listitem> <para> - Set this option to 'true' - if an User Principle Name (UPN) cannot be found in sysdb - and you want to use an UPN like 'username@realm'. + Set this option to ´true´ if the identity provider + cannot supply an User Principle Name (UPN). In this + case sssd will try to request a TGT with an UPN + build as ´username@realm´. </para> <para> </snip> Default: false
Okay, as I see it know, if only the username is stored in the db, you can set this to true and upon kerberos authentication the request will be sent with username@realm and realm is what is defined in krb5REALM ... correct? If so, "kbr5try_simple_upn", is still confusing. why not krb5_construct_upn or something ... ? ~Jenny
On Fri, 2009-09-25 at 15:09 +0200, Sumit Bose wrote:
Hi,
this patch to the sssd-krb5 man page should clarify how the krb5 provider will find the right UPN.
This hopefully fixes #204.
Please fell free to correct any grammar or spelling mistakes.
Ack but I think some native english speaker should check it too :-)
Simo.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 09/25/2009 09:09 AM, Sumit Bose wrote:
Hi,
this patch to the sssd-krb5 man page should clarify how the krb5 provider will find the right UPN.
This hopefully fixes #204.
Please fell free to correct any grammar or spelling mistakes.
bye, Sumit
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel
Just a few minor nitpicks. 1) Please rebase atop the current master.
I'd rewrite the following paragraph: The Kerberos 5 authentication backend does not contain an identity provider. But some useful information can only be delivered by an identity provider, e.g. the User's Principle Name (UPN). If the identity provider knows the UPN, e.g. this is the case in Active Directory or FreeIPA domains, it can be saved in <command>sssd's</command> internal cache and used by the Kerberos 5 authentication backend. Please refer to the man page of the used identity provider to see how to configure this.
as
The Kerberos 5 authentication backend does not contain an identity provider and must be paired with one in order to function properly (for example, id_provider = ldap). Some information required by the Kerberos 5 authentication backend must be provider by the identity provider, such as the user's Kerberos Principal Name (UPN). The configuration of the identity provider should have an entry to specify the UPN. Please refer to the man page for the applicable identity provider for details on how to configure this.
Under krb5try_simple_upn, please change "an User Principal Name" to "a User Principal Name". I'd also recommend that the last sentence read: "In this case, SSSD will construct a UPN using the format <replaceable>username</replaceable>@<replaceable>krb5_realm</replaceable>"
- -- Stephen Gallagher RHCE 804006346421761
Looking to carve out IT costs? www.redhat.com/carveoutcosts/
On Fri, Sep 25, 2009 at 09:40:49AM -0400, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 09/25/2009 09:09 AM, Sumit Bose wrote:
Hi,
this patch to the sssd-krb5 man page should clarify how the krb5 provider will find the right UPN.
This hopefully fixes #204.
Please fell free to correct any grammar or spelling mistakes.
bye, Sumit
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel
Just a few minor nitpicks.
- Please rebase atop the current master.
I'd rewrite the following paragraph: The Kerberos 5 authentication backend does not contain an identity provider. But some useful information can only be delivered by an identity provider, e.g. the User's Principle Name (UPN). If the identity provider knows the UPN, e.g. this is the case in Active Directory or FreeIPA domains, it can be saved in <command>sssd's</command> internal cache and used by the Kerberos 5 authentication backend. Please refer to the man page of the used identity provider to see how to configure this.
as
The Kerberos 5 authentication backend does not contain an identity provider and must be paired with one in order to function properly (for example, id_provider = ldap). Some information required by the Kerberos 5 authentication backend must be provider by the identity provider, such as the user's Kerberos Principal Name (UPN). The configuration of the identity provider should have an entry to specify the UPN. Please refer to the man page for the applicable identity provider for details on how to configure this.
Under krb5try_simple_upn, please change "an User Principal Name" to "a User Principal Name". I'd also recommend that the last sentence read: "In this case, SSSD will construct a UPN using the format <replaceable>username</replaceable>@<replaceable>krb5_realm</replaceable>"
After some discussion it became clear that it might be easier to drop the krb5try_simple_upn option at all and make the logic behind a default fallback if the UPN cannot be found in sysdb. This patch does exacly that.
Stephen's comments are included in the updated man page.
bye, Sumit
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 09/25/2009 11:40 AM, Sumit Bose wrote:
On Fri, Sep 25, 2009 at 09:40:49AM -0400, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 09/25/2009 09:09 AM, Sumit Bose wrote:
Hi,
this patch to the sssd-krb5 man page should clarify how the krb5 provider will find the right UPN.
This hopefully fixes #204.
Please fell free to correct any grammar or spelling mistakes.
bye, Sumit
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel
Just a few minor nitpicks.
- Please rebase atop the current master.
I'd rewrite the following paragraph: The Kerberos 5 authentication backend does not contain an identity provider. But some useful information can only be delivered by an identity provider, e.g. the User's Principle Name (UPN). If the identity provider knows the UPN, e.g. this is the case in Active Directory or FreeIPA domains, it can be saved in <command>sssd's</command> internal cache and used by the Kerberos 5 authentication backend. Please refer to the man page of the used identity provider to see how to configure this.
as
The Kerberos 5 authentication backend does not contain an identity provider and must be paired with one in order to function properly (for example, id_provider = ldap). Some information required by the Kerberos 5 authentication backend must be provider by the identity provider, such as the user's Kerberos Principal Name (UPN). The configuration of the identity provider should have an entry to specify the UPN. Please refer to the man page for the applicable identity provider for details on how to configure this.
Under krb5try_simple_upn, please change "an User Principal Name" to "a User Principal Name". I'd also recommend that the last sentence read: "In this case, SSSD will construct a UPN using the format <replaceable>username</replaceable>@<replaceable>krb5_realm</replaceable>"
After some discussion it became clear that it might be easier to drop the krb5try_simple_upn option at all and make the logic behind a default fallback if the UPN cannot be found in sysdb. This patch does exacly that.
Stephen's comments are included in the updated man page.
bye, Sumit
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel
Ack. I will push with one minor typo fixed (my fault, it was in my original review).
- -- Stephen Gallagher RHCE 804006346421761
Looking to carve out IT costs? www.redhat.com/carveoutcosts/
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 09/25/2009 12:13 PM, Stephen Gallagher wrote:
On 09/25/2009 11:40 AM, Sumit Bose wrote:
On Fri, Sep 25, 2009 at 09:40:49AM -0400, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 09/25/2009 09:09 AM, Sumit Bose wrote:
Hi,
this patch to the sssd-krb5 man page should clarify how the krb5 provider will find the right UPN.
This hopefully fixes #204.
Please fell free to correct any grammar or spelling mistakes.
bye, Sumit
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel
Just a few minor nitpicks.
- Please rebase atop the current master.
I'd rewrite the following paragraph: The Kerberos 5 authentication backend does not contain an identity provider. But some useful information can only be delivered by an identity provider, e.g. the User's Principle Name (UPN). If the identity provider knows the UPN, e.g. this is the case in Active Directory or FreeIPA domains, it can be saved in <command>sssd's</command> internal cache and used by the Kerberos 5 authentication backend. Please refer to the man page of the used identity provider to see how to configure this.
as
The Kerberos 5 authentication backend does not contain an identity provider and must be paired with one in order to function properly (for example, id_provider = ldap). Some information required by the Kerberos 5 authentication backend must be provider by the identity provider, such as the user's Kerberos Principal Name (UPN). The configuration of the identity provider should have an entry to specify the UPN. Please refer to the man page for the applicable identity provider for details on how to configure this.
Under krb5try_simple_upn, please change "an User Principal Name" to "a User Principal Name". I'd also recommend that the last sentence read: "In this case, SSSD will construct a UPN using the format <replaceable>username</replaceable>@<replaceable>krb5_realm</replaceable>"
After some discussion it became clear that it might be easier to drop the krb5try_simple_upn option at all and make the logic behind a default fallback if the UPN cannot be found in sysdb. This patch does exacly that.
Stephen's comments are included in the updated man page.
bye, Sumit
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel
Ack. I will push with one minor typo fixed (my fault, it was in my original review).
Fixed a one-character typo.
Pushed to master. _______________________________________________ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel
- -- Stephen Gallagher RHCE 804006346421761
Looking to carve out IT costs? www.redhat.com/carveoutcosts/
sssd-devel@lists.fedorahosted.org