[SSSD] [PATCH] Add dummy credentials to an empty ccache file

Stephen Gallagher sgallagh at redhat.com
Tue Dec 8 17:14:27 UTC 2009


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 12/08/2009 06:25 AM, Sumit Bose wrote:
> Hi,
> 
> this patch is the first step to solve #304. It adds some more
> information into an empty ticket. I think this is as much we can do to
> make krb5-auth-dialog happy, because krb5-auth-dialog overwrites the
> client principal found in the ccache with its own data in
> ka_parse_name(). This data is either just the user name, and the realm
> is added by the kerberos libraries is default_realm from krb5.conf, or
> if set the principal set with krb5-auth-dialog-preferences is taken.
> 
> For a quick fix there are two possibilites
> - set the default_realm in krb5.conf or
> - set the principal with krb5-auth-dialog-preferences
> 
> Additionally I'll try to contact the authors of krb5-auth-dialog to see
> if they agree to try with the principal found in the ccache file if the
> principal is not explictly and use the user name as a fallback.
> 
> bye,
> Sumit
> 

Tested and acked.

Also, I'm not sure what else we need to do. On F12 at least,
krb5-auth-dialog behaved correctly for me.

I rebooted my system and logged in offline. krb5-auth-dialog properly
informed me that my credentials were expired. I reconnected to the
network and refreshed my credentials using the auth dialog.

- From an end-user perspective, this is behaving the same as a traditional
Kerberos setup. I think we can close #304 with this patch.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkseiXAACgkQeiVVYja6o6NdCQCfXW0wXGODJLjhdM5mErCcHQ9M
qZIAn3RFootrQLQxt/HMyRlctDpG5w3W
=m4XP
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list