[SSSD] [PATCHES] Add support for FAST in krb5 provider

Sumit Bose sbose at redhat.com
Mon Dec 6 14:07:06 UTC 2010


On Mon, Dec 06, 2010 at 08:38:54AM -0500, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 12/03/2010 03:56 PM, Sumit Bose wrote:
> >> Although it might be recommended it is not necessary that the keytab
> >> entry for FAST or the TGT validation comes from the same REALM, only the
> >> KDC needs to know how the create tickets for the principal. One use case
> >> e.g. would be a setup with AD and IPA where the user principal coming
> >> from the AD realm and the host entry in the keytab from the IPA realm
> >> and both realm trust each other.
> > 
> 
> I don't understand still why just taking the last entry in the keytab
> makes sense. If we have a contrived situation like the one you describe,
> wouldn't it be more sensible for us to add an option to specify the
> principal in the keytab that we're looking for, rather than hoping that
> the last one in the list happens to be correct?

I think this is a good idea. Would you mind opening a ticket to add
krb5_validate_principal and krb5_fast_principal options?

bye,
Sumit

> 
> - -- 
> Stephen Gallagher
> RHCE 804006346421761
> 
> Delivering value year after year.
> Red Hat ranks #1 in value among software vendors.
> http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
> 
> iEYEARECAAYFAkz8524ACgkQeiVVYja6o6NGpwCggbBmWvcSQna+ysODavxkvzRX
> 6moAnRG2q+mSFB1BaLZOfNsrivLAKMxx
> =LOyt
> -----END PGP SIGNATURE-----
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel



More information about the sssd-devel mailing list