On Fri, May 03, 2013 at 08:47:06PM +0200, Sumit Bose wrote:
On Fri, May 03, 2013 at 07:56:48PM +0200, Jakub Hrozek wrote:
> Currently when enterprise principals are enabled in the AD provider, we
> check if the UPN is the same as we'd expect. But when enterprise
> principals are enabled (which is by default in AD provider), then the
> principal krb5_child returns is different from what SSSD expects.
>
> Sumit, you wrote the enterprise principal support, do you know if there
> is a better way than disabling the check altogether? Can we expect the
> principal in the form krb5_child sends it? This is how the principal
> looked on my setup for user "testlogin:
>
> $ klist
> Ticket cache: DIR::/run/user/947005183/krb5cc/tktDSjgIe
> Default principal: testlogin\@SSSD-AD.TEST(a)SSSD-AD.TEST
>
> Valid starting Expires Service principal
> 05/03/13 17:52:32 05/04/13 03:52:32 krbtgt/SSSD-AD.TEST(a)SSSD-AD.TEST
> renew until 05/10/13 17:52:32
Makes sense. ACK
bye,
Sumit
Thank you for the review, I opened
https://fedorahosted.org/sssd/ticket/1906 to investigate the check
deeper post-beta.