[SSSD] sssd and kerberos.
Timo Aaltonen
tjaalton at cc.hut.fi
Thu Aug 5 15:25:48 UTC 2010
On Thu, 5 Aug 2010, Patrik Martinsson wrote:
> Hey,
>
> I got this working today with these settings,
>
> ldap_uri = ldap://foo.bar
> ldap_sasl_mech = gssapi
> ldap_krb5_keytab = /etc/krb5.keytab
> ldap_sasl_authid = nfs/xx.xxxx.xx
....
<snip>
Looks like you need kerberized NFS? See this patch that I made for
nfs-utils:
http://users.tkk.fi/~tjaalton/0001-Check-for-AD-style-machine-principal-name.patch
still not accepted upstream, but I'm hoping for the best. With this you
don't need to add "nfs/*" UPN:s, gssd will initialize and use HOSTNAME$
just fine.
Maybe a similar approach could be used with sssd, so there would be no
need to specify the authid (which is different for every hostname)?
ps. still fighting with the installation.. so can't test the above and
post logs just yet. Tomorrow, I promise :)
--
Timo Aaltonen
Systems Specialist, Aalto IT
More information about the sssd-devel
mailing list