[SSSD] [PATCH] remove krb5_try_simple_upn option and make it a default fallback [was: [PATCH] extend sssd-krb5 man page]

Stephen Gallagher sgallagh at redhat.com
Fri Sep 25 17:01:38 UTC 2009


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 09/25/2009 12:13 PM, Stephen Gallagher wrote:
> On 09/25/2009 11:40 AM, Sumit Bose wrote:
>> On Fri, Sep 25, 2009 at 09:40:49AM -0400, Stephen Gallagher wrote:
>>> -----BEGIN PGP SIGNED MESSAGE-----
>>> Hash: SHA1
>>>
>>> On 09/25/2009 09:09 AM, Sumit Bose wrote:
>>>> Hi,
>>>>
>>>> this patch to the sssd-krb5 man page should clarify how the krb5
>>>> provider will find the right UPN.
>>>>
>>>> This hopefully fixes #204.
>>>>
>>>> Please fell free to correct any grammar or spelling mistakes.
>>>>
>>>> bye,
>>>> Sumit
>>>>
>>>>
>>>> ------------------------------------------------------------------------
>>>>
>>>> _______________________________________________
>>>> sssd-devel mailing list
>>>> sssd-devel at lists.fedorahosted.org
>>>> https://fedorahosted.org/mailman/listinfo/sssd-devel
>>>
>>> Just a few minor nitpicks.
>>> 1) Please rebase atop the current master.
>>>
>>> I'd rewrite the following paragraph:
>>> The Kerberos 5 authentication backend does not contain an identity
>>> provider. But some useful information can only be delivered by an
>>> identity provider, e.g. the User's Principle Name (UPN). If the
>>> identity provider knows the UPN, e.g. this is the case in Active
>>> Directory or FreeIPA domains, it can be saved in
>>> <command>sssd's</command> internal cache and used by the Kerberos 5
>>> authentication backend. Please refer to the man page of the used
>>> identity provider to see how to configure this.
>>>
>>> as
>>>
>>> The Kerberos 5 authentication backend does not contain an identity
>>> provider and must be paired with one in order to function properly (for
>>> example, id_provider = ldap). Some information required by the Kerberos
>>> 5 authentication backend must be provider by the identity provider, such
>>> as the user's Kerberos Principal Name (UPN). The configuration of the
>>> identity provider should have an entry to specify the UPN. Please refer
>>> to the man page for the applicable identity provider for details on how
>>> to configure this.
>>>
>>>
>>> Under krb5try_simple_upn, please change "an User Principal Name" to "a
>>> User Principal Name". I'd also recommend that the last sentence read:
>>> "In this case, SSSD will construct a UPN using the format
>>> <replaceable>username</replaceable>@<replaceable>krb5_realm</replaceable>"
>>>
> 
>> After some discussion it became clear that it might be easier to drop
>> the krb5try_simple_upn option at all and make the logic behind a default
>> fallback if the UPN cannot be found in sysdb. This patch does exacly
>> that.
> 
>> Stephen's comments are included in the updated man page.
> 
>> bye,
>> Sumit
> 
> 
>> ------------------------------------------------------------------------
> 
>> _______________________________________________
>> sssd-devel mailing list
>> sssd-devel at lists.fedorahosted.org
>> https://fedorahosted.org/mailman/listinfo/sssd-devel
> 
> Ack. I will push with one minor typo fixed (my fault, it was in my
> original review).
> 

Fixed a one-character typo.

Pushed to master.
_______________________________________________
sssd-devel mailing list
sssd-devel at lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel

- -- 
Stephen Gallagher
RHCE 804006346421761

Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkq893IACgkQeiVVYja6o6MX3ACfR9p2Qg2CxiXdWGgcbrqc7dqA
ZMEAn1pPzdLtJEdQglp15TvJpSIrnE5n
=eoKc
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list