URL: https://github.com/SSSD/sssd/pull/813 Author: sumit-bose Title: #813: SDAP: allow GSS-SPNEGO for LDAP SASL bind as well Action: opened
PR body: """ From the LDAP client perspective GSS-SPNEGO and GSSAPI are quite similar. To support GSS-SPNEGO SSSD must make sure that a Kerberos ticket is available before the LDAP SASL bind is started.
Related to https://pagure.io/SSSD/sssd/issue/4006 """
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/813/head:pr813 git checkout pr813
URL: https://github.com/SSSD/sssd/pull/813 Title: #813: SDAP: allow GSS-SPNEGO for LDAP SASL bind as well
simo5 commented: """ LGTM, would it make sense to have a followup where GSS-SPNEGO is made the default for the AD backend? GSS_SPNEGO is more efficient as it requires less roundtrips. """
See the full comment at https://github.com/SSSD/sssd/pull/813#issuecomment-491860329
URL: https://github.com/SSSD/sssd/pull/813 Title: #813: SDAP: allow GSS-SPNEGO for LDAP SASL bind as well
sumit-bose commented: """
LGTM, would it make sense to have a followup where GSS-SPNEGO is made the default for the AD backend? GSS_SPNEGO is more efficient as it requires less roundtrips.
Yes, that's the plan, see https://pagure.io/SSSD/sssd/issue/4007.
While testing the patch I found that there are issues with GSS-SPNEGO with cyrus-sasl-2.1.26 while cyrus-sasl-2.1.27 worked fine. I'd like to run some more tests to see if it would makes sense to not change the default for the AD provider if cyrus-sasl-2.1.26 is installed.
bye, Sumit """
See the full comment at https://github.com/SSSD/sssd/pull/813#issuecomment-491867722
URL: https://github.com/SSSD/sssd/pull/813 Title: #813: SDAP: allow GSS-SPNEGO for LDAP SASL bind as well
simo5 commented: """ We changed GSS-SPNEGO incompatibly at some point, and 2.1.27 may actually be that point. We did change it because it didn't work as it should have (was not interoperable with Windows). So we definitely should check that we have a recent enough cyrus-sasl. """
See the full comment at https://github.com/SSSD/sssd/pull/813#issuecomment-491892022
URL: https://github.com/SSSD/sssd/pull/813 Title: #813: SDAP: allow GSS-SPNEGO for LDAP SASL bind as well
jhrozek commented: """ In multi-domain AD environment, the subdomains still use GSSAPI even though I specify SPNEGO for the joined domain. Specifying the mechanism for the subdomain works fine, but I wonder if this is an oversight or intended for some reason? """
See the full comment at https://github.com/SSSD/sssd/pull/813#issuecomment-493234490
URL: https://github.com/SSSD/sssd/pull/813 Title: #813: SDAP: allow GSS-SPNEGO for LDAP SASL bind as well
sumit-bose commented: """
In multi-domain AD environment, the subdomains still use GSSAPI even though I specify SPNEGO for the joined domain. Specifying the mechanism for the subdomain works fine, but I wonder if this is an oversight or intended for some reason?
Thanks for checking, that is an oversight. I'll make sure the option is inherited by default. I think this would be expected behavior. If there really is a sub-domain where GSS-SPNEGO would not work it can be overwritten with a sub-domain option. """
See the full comment at https://github.com/SSSD/sssd/pull/813#issuecomment-493323551
URL: https://github.com/SSSD/sssd/pull/813 Title: #813: SDAP: allow GSS-SPNEGO for LDAP SASL bind as well
Label: +Changes requested
URL: https://github.com/SSSD/sssd/pull/813 Author: sumit-bose Title: #813: SDAP: allow GSS-SPNEGO for LDAP SASL bind as well Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/813/head:pr813 git checkout pr813
URL: https://github.com/SSSD/sssd/pull/813 Author: sumit-bose Title: #813: SDAP: allow GSS-SPNEGO for LDAP SASL bind as well Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/813/head:pr813 git checkout pr813
URL: https://github.com/SSSD/sssd/pull/813 Title: #813: SDAP: allow GSS-SPNEGO for LDAP SASL bind as well
sumit-bose commented: """ Hi,
the latest version include a second patch which takes care of the sub-domains. The expected behavior is that the value of ldap_sasl_mech is inherited automatically but can be overwritten in the sub-domain config.
bye, Sumit """
See the full comment at https://github.com/SSSD/sssd/pull/813#issuecomment-494306691
URL: https://github.com/SSSD/sssd/pull/813 Title: #813: SDAP: allow GSS-SPNEGO for LDAP SASL bind as well
Label: -Changes requested
URL: https://github.com/SSSD/sssd/pull/813 Title: #813: SDAP: allow GSS-SPNEGO for LDAP SASL bind as well
jhrozek commented: """ Looks good and works fine. I'll add accepted once coverity finishes. """
See the full comment at https://github.com/SSSD/sssd/pull/813#issuecomment-494360132
URL: https://github.com/SSSD/sssd/pull/813 Title: #813: SDAP: allow GSS-SPNEGO for LDAP SASL bind as well
Label: +Accepted
URL: https://github.com/SSSD/sssd/pull/813 Title: #813: SDAP: allow GSS-SPNEGO for LDAP SASL bind as well
jhrozek commented: """ * master: * 070f22f896b909c140ed7598aed2393d61a834ae * 3b89934e831fa4e575e398fee6e4c3d4d24854eb * sssd-1-16: * 373b1136ccb3bf54f32d47473e8120d0258f8405 * f5d031ba41b1c297f95df61f013f1c7ef8bca275
"""
See the full comment at https://github.com/SSSD/sssd/pull/813#issuecomment-494539996
URL: https://github.com/SSSD/sssd/pull/813 Author: sumit-bose Title: #813: SDAP: allow GSS-SPNEGO for LDAP SASL bind as well Action: closed
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/813/head:pr813 git checkout pr813
URL: https://github.com/SSSD/sssd/pull/813 Title: #813: SDAP: allow GSS-SPNEGO for LDAP SASL bind as well
Label: +Pushed
sssd-devel@lists.fedorahosted.org
-
jhrozek -
simo5
-
sumit-bose