Currently when enterprise principals are enabled in the AD provider, we
check if the UPN is the same as we'd expect. But when enterprise
principals are enabled (which is by default in AD provider), then the
principal krb5_child returns is different from what SSSD expects.
Sumit, you wrote the enterprise principal support, do you know if there
is a better way than disabling the check altogether? Can we expect the
principal in the form krb5_child sends it? This is how the principal
looked on my setup for user "testlogin:
$ klist
Ticket cache: DIR::/run/user/947005183/krb5cc/tktDSjgIe
Default principal: testlogin\@SSSD-AD.TEST(a)SSSD-AD.TEST
Valid starting Expires Service principal
05/03/13 17:52:32 05/04/13 03:52:32 krbtgt/SSSD-AD.TEST(a)SSSD-AD.TEST
renew until 05/10/13 17:52:32
Show replies by thread