[SSSD] [PATCH] extend sssd-krb5 man page

Jenny Galipeau jgalipea at redhat.com
Fri Sep 25 13:27:09 UTC 2009


Sumit Bose wrote:
> Hi,
>
> this patch to the sssd-krb5 man page should clarify how the krb5
> provider will find the right UPN.
>
> This hopefully fixes #204.
>
> Please fell free to correct any grammar or spelling mistakes.
>
> bye,
> Sumit
>   
> ------------------------------------------------------------------------
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel
<snip>

                     <term>krb5try_simple_upn (boolean)</term>
                     <listitem>
                         <para>
-                            Set this option to 'true'
-                            if an User Principle Name (UPN) cannot be found in sysdb
-                            and you want to use an UPN like 'username at realm'.
+                            Set this option to ´true´ if the identity provider
+                            cannot supply an User Principle Name (UPN). In this
+                            case sssd will try to request a TGT with an UPN
+                            build as ´username at realm´.
                         </para>
                         <para>
</snip>
                             Default: false

Okay, as I see it know, if only the username is stored in the db, you 
can set this to true and upon kerberos authentication the request will 
be sent with username at realm  and realm is what is defined in krb5REALM 
... correct?   If so, "kbr5try_simple_upn", is still confusing.  why not 
krb5_construct_upn  or something ... ?
~Jenny

-- 
Jenny Galipeau <jgalipea at redhat.com>
Principal Software QA Engineer
Red Hat, Inc. Security Engineering




More information about the sssd-devel mailing list