-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
This series of patches implement creation of kdcinfo files when GSSAPI is used with pure LDAP provider.
[PATCH 1/4] Add KDC to the list of LDAP options A simple patch that adds a way to specify the KDC
[PATCH 2/4] Report Kerberos error code from ldap_child_get_tgt_sync While looking at the ldap_child code, I noticed that the call to ldap_child_get_tgt_sync should return the Kerberos specific error code rather than errno.
[PATCH 3/4] Make ldap_child report kerberos return code to parent The buffer used to communicate between parent and child now contains a new parameter which is the Kerberos error code. An example of use of this is detecting that KDC was unreachable in the following patch.
[PATCH 4/4] Initialize kerberos service for GSSAPI I'm not very fond of patch #4 myself - the reason is that as far as I remember, the sdap_ modules were meant to be a rather thin wrapper to provide an "async set of LDAP calls", the provider and backend-specific calls belong one level up, to the ldap_ modules. However, in order to support fail over in during sdap_kinit_, I used the be_resolve_ family functions there, which looks like breaking the abstraction level quite a bit. If there are any suggestions on how to accomplish the kinit w/ fail over better, I'll be glad to hear them.
Jakub Hrozek wrote:
This series of patches implement creation of kdcinfo files when GSSAPI is used with pure LDAP provider.
[PATCH 1/4] Add KDC to the list of LDAP options A simple patch that adds a way to specify the KDC
What about man pages? If we add an option should we update man pages?
[PATCH 2/4] Report Kerberos error code from ldap_child_get_tgt_sync While looking at the ldap_child code, I noticed that the call to ldap_child_get_tgt_sync should return the Kerberos specific error code rather than errno.
[PATCH 3/4] Make ldap_child report kerberos return code to parent The buffer used to communicate between parent and child now contains a new parameter which is the Kerberos error code. An example of use of this is detecting that KDC was unreachable in the following patch.
[PATCH 4/4] Initialize kerberos service for GSSAPI I'm not very fond of patch #4 myself - the reason is that as far as I remember, the sdap_ modules were meant to be a rather thin wrapper to provide an "async set of LDAP calls", the provider and backend-specific calls belong one level up, to the ldap_ modules. However, in order to support fail over in during sdap_kinit_, I used the be_resolve_ family functions there, which looks like breaking the abstraction level quite a bit. If there are any suggestions on how to accomplish the kinit w/ fail over better, I'll be glad to hear them.
-------------------------
_______________________________________________ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 09/07/2010 02:25 PM, Dmitri Pal wrote:
What about man pages? If we add an option should we update man pages?
We should. I was under the impression that we say something like "look at the options in the sssd-krb5 man page if you need to use GSSAPI" but apparently I was wrong.
I take this as a Nack. Thanks, Dmitri.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 09/07/2010 02:28 PM, Jakub Hrozek wrote:
On 09/07/2010 02:25 PM, Dmitri Pal wrote:
What about man pages? If we add an option should we update man pages?
We should. I was under the impression that we say something like "look at the options in the sssd-krb5 man page if you need to use GSSAPI" but apparently I was wrong.
I take this as a Nack. Thanks, Dmitri.
Sorry, I forgot to resend the patches. Attached.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 09/30/2010 09:11 AM, Jakub Hrozek wrote:
On 09/07/2010 02:28 PM, Jakub Hrozek wrote:
On 09/07/2010 02:25 PM, Dmitri Pal wrote:
What about man pages? If we add an option should we update man pages?
We should. I was under the impression that we say something like "look at the options in the sssd-krb5 man page if you need to use GSSAPI" but apparently I was wrong.
I take this as a Nack. Thanks, Dmitri.
Sorry, I forgot to resend the patches. Attached.
Ack to all four
- -- Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 10/13/2010 08:21 AM, Stephen Gallagher wrote:
On 09/30/2010 09:11 AM, Jakub Hrozek wrote:
On 09/07/2010 02:28 PM, Jakub Hrozek wrote:
On 09/07/2010 02:25 PM, Dmitri Pal wrote:
What about man pages? If we add an option should we update man pages?
We should. I was under the impression that we say something like "look at the options in the sssd-krb5 man page if you need to use GSSAPI" but apparently I was wrong.
I take this as a Nack. Thanks, Dmitri.
Sorry, I forgot to resend the patches. Attached.
Ack to all four
Pushed to master.
- -- Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/
sssd-devel@lists.fedorahosted.org