[SSSD] sssd and kerberos.

Patrik Martinsson Patrik.Martinsson at smhi.se
Fri Aug 6 08:45:05 UTC 2010


Ah, yes i do use kerberized NFS, and i also want to use sasl gssapi to 
authenticate the sssd.

My understanding was that i needed upn=nfs/* to get nfsv4 krb, however 
with your patch
(i applied it on nfs-utils-1.2.2-4.el6.x86_64) i dont need upn=nfs/* 
anymore as you say. Although
i do need upn=host/*, but maybe that's how it supporse to be ? My 
knowledge to kerberos and
AD is very limited unfortunately so when discussing this I'm on very 
thin ice.

Now with that nfs-utils-patch applied, and sssd 1.3 i got both sssd and 
nfsv4 working with upn=host/*.

 > Maybe a similar approach could be used with sssd, so there would be no
 > need to specify the authid (which is different for every hostname)?

I think it do use that approach, however it gives you the possibility to 
change your authid if want to, that's
how i understand anyways.

Again, maybe this is not the correct mailinglist for this discussion.

Btw,. if your patch is correct why isn't it accepted upstreams ?

Best regards,
Patrik Martinsson, Sweden.


On 08/05/2010 05:25 PM, Timo Aaltonen wrote:
> On Thu, 5 Aug 2010, Patrik Martinsson wrote:
>
>    
>> Hey,
>>
>> I got this working today with these settings,
>>
>> ldap_uri = ldap://foo.bar
>> ldap_sasl_mech = gssapi
>> ldap_krb5_keytab = /etc/krb5.keytab
>> ldap_sasl_authid = nfs/xx.xxxx.xx
>>      
> ....
> <snip>
>
> Looks like you need kerberized NFS? See this patch that I made for
> nfs-utils:
>
> http://users.tkk.fi/~tjaalton/0001-Check-for-AD-style-machine-principal-name.patch
>
> still not accepted upstream, but I'm hoping for the best. With this you
> don't need to add "nfs/*" UPN:s, gssd will initialize and use HOSTNAME$
> just fine.
>
> Maybe a similar approach could be used with sssd, so there would be no
> need to specify the authid (which is different for every hostname)?
>
>
> ps. still fighting with the installation.. so can't test the above and
> post logs just yet. Tomorrow, I promise :)
>
>    



More information about the sssd-devel mailing list