[SSSD] sssd and kerberos.

Timo Aaltonen tjaalton at cc.hut.fi
Tue Aug 10 13:58:31 UTC 2010


On Fri, 6 Aug 2010, Patrik Martinsson wrote:

> Ah, yes i do use kerberized NFS, and i also want to use sasl gssapi to
> authenticate the sssd.
>
> My understanding was that i needed upn=nfs/* to get nfsv4 krb, however 
> with your patch (i applied it on nfs-utils-1.2.2-4.el6.x86_64) i dont 
> need upn=nfs/* anymore as you say. Although i do need upn=host/*, but 
> maybe that's how it supporse to be ? My knowledge to kerberos and AD is 
> very limited unfortunately so when discussing this I'm on very thin ice.

No, with the patch you don't need to use 'upn=...' at all, gssd would then 
use the default HOST$ principalname.

though the problem with sssd remains. Maybe I should begin using 
'upn=host/..' too..

> Now with that nfs-utils-patch applied, and sssd 1.3 i got both sssd and
> nfsv4 working with upn=host/*.
>
> > Maybe a similar approach could be used with sssd, so there would be no
> > need to specify the authid (which is different for every hostname)?
>
> I think it do use that approach, however it gives you the possibility to
> change your authid if want to, that's
> how i understand anyways.
>
> Again, maybe this is not the correct mailinglist for this discussion.
>
> Btw,. if your patch is correct why isn't it accepted upstreams ?

It's making an already complicated function more unreadable, so it needs 
to be cleaned up first and then add a revised patch on top.


-- 
Timo Aaltonen
Systems Specialist, Aalto IT



More information about the sssd-devel mailing list