[SSSD] [PATCHES] Add support for FAST in krb5 provider

Stephen Gallagher sgallagh at redhat.com
Mon Dec 6 13:38:54 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 12/03/2010 03:56 PM, Sumit Bose wrote:
>> Although it might be recommended it is not necessary that the keytab
>> entry for FAST or the TGT validation comes from the same REALM, only the
>> KDC needs to know how the create tickets for the principal. One use case
>> e.g. would be a setup with AD and IPA where the user principal coming
>> from the AD realm and the host entry in the keytab from the IPA realm
>> and both realm trust each other.
> 

I don't understand still why just taking the last entry in the keytab
makes sense. If we have a contrived situation like the one you describe,
wouldn't it be more sensible for us to add an option to specify the
principal in the keytab that we're looking for, rather than hoping that
the last one in the list happens to be correct?

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkz8524ACgkQeiVVYja6o6NGpwCggbBmWvcSQna+ysODavxkvzRX
6moAnRG2q+mSFB1BaLZOfNsrivLAKMxx
=LOyt
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list