On Wed, Jul 06, 2016 at 06:24:08PM +0200, Jakub Hrozek wrote:
On Tue, Jul 05, 2016 at 12:54:34PM +0200, Sumit Bose wrote:
> Hi,
>
> the following 4 patches include fixes for
>
ttps://fedorahosted.org/sssd/ticket/2788 and
>
https://fedorahosted.org/sssd/ticket/3041. They are not related but
> depend on each other patch-wise, so I put them in a single mail. Please
> let me know if you prefer to review them separately then I can them in
> to different threads.
>
> The first patch just removes the 'enable_only = sssd' like which
> effectively disables the default localauth mechanisms like checking
> .k5login. I thought we already did this some time ago but apparently not.
> While I was at it I made SSSD's localauth plugin non-authoritative for
> SSSD users as well (it already is non-authoritative for non-SSSD users,
> i.e. it returns KRB5_PLUGIN_NO_HANDLE which leaves the final decision to
> a different module). This would allow the usage of .k5login files for
> SSSD users as well.
>
> The third and fourth patch create a new krb5 config snippet
> krb5_libdefaults which will set 'canonicalize = true' if the related
> SSSD option is true as well, which is currently by default the case for
> the IPA provider.
>
> bye,
> Sumit
(Apologies if this gets to the list twice, I thought I already sent one
mail)
We did a review over the phone with Sumit and he answered my questions
about the code. I also tested the snippets are generated as they should.
CI:
http://sssd-ci.duckdns.org/logs/job/47/31/summary.html - both
failures here are unrelated.
ACK
master:
* e6b6b9fa79c67d7d2698bc7e33d2e2f6bb53d483
* d278822ab3ab18f2c5b012cd055f01f06e687e49
* 2ca45dfa0144fea08bd360dafded57bc90111e68
* 2658ad37cd04f211aa28b1d71acb27c4edfb03da