[SSSD] [PATCH] Replace krb5_kdcip by krb5_server in LDAP provider

Sumit Bose sbose at redhat.com
Tue Dec 7 12:24:34 UTC 2010


Hi,

during the GSSAPI initialisation in the LDAP provider the deprecated
option krb5_kdcip was still used. The patch replaces it with krb5_server
and a fall-back to krb5_kdcip.

This patch should fix trac ticket #692.

bye,
Sumit
-------------- next part --------------
From 8328804fbe4c61f60844e859d370669dbda7214f Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Tue, 7 Dec 2010 13:18:39 +0100
Subject: [PATCH] Replace krb5_kdcip by krb5_server in LDAP provider

---
 src/man/sssd-ldap.5.xml          |    8 +++++++-
 src/providers/ipa/ipa_common.c   |    4 ++--
 src/providers/krb5/krb5_common.c |   12 +++++++-----
 src/providers/krb5/krb5_common.h |    3 ++-
 src/providers/ldap/ldap_common.c |   14 +++++++++++---
 src/providers/ldap/sdap.h        |    2 +-
 6 files changed, 30 insertions(+), 13 deletions(-)

diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index 786d5fd..3406dc4 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -909,7 +909,7 @@
                 </varlistentry>
 
                 <varlistentry>
-                    <term>krb5_kdcip (string)</term>
+                    <term>krb5_server (string)</term>
                     <listitem>
                         <para>
                             Specifies the list of IP addresses or hostnames
@@ -928,6 +928,12 @@
                             SSSD first searches for DNS entries that specify _udp as
                             the protocol and falls back to _tcp if none are found.
                         </para>
+                        <para>
+                            This option was named <quote>krb5_kdcip</quote> in
+                            earlier releases of SSSD. While the legacy name is recognized
+                            for the time being, users are advised to migrate their config
+                            files to use <quote>krb5_server</quote> instead.
+                        </para>
                     </listitem>
                 </varlistentry>
 
diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c
index 35583af..830d0ce 100644
--- a/src/providers/ipa/ipa_common.c
+++ b/src/providers/ipa/ipa_common.c
@@ -67,7 +67,7 @@ struct dp_option ipa_def_ldap_opts[] = {
     { "ldap_krb5_keytab", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "ldap_krb5_init_creds", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
     /* use the same parm name as the krb5 module so we set it only once */
-    { "krb5_kdcip", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "krb5_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "ldap_pwd_policy", DP_OPT_STRING, { "none" } , NULL_STRING },
     { "ldap_referrals", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
@@ -458,7 +458,7 @@ int ipa_get_auth_options(struct ipa_options *ipa_opts,
 
     /* If there is no KDC, try the deprecated krb5_kdcip option, too */
     /* FIXME - this can be removed in a future version */
-    ret = krb5_try_kdcip(ipa_opts, cdb, conf_path, ipa_opts->auth);
+    ret = krb5_try_kdcip(ipa_opts, cdb, conf_path, ipa_opts->auth, KRB5_KDC);
     if (ret != EOK) {
         DEBUG(1, ("sss_krb5_try_kdcip failed.\n"));
         goto done;
diff --git a/src/providers/krb5/krb5_common.c b/src/providers/krb5/krb5_common.c
index 25188c5..d2fcf1c 100644
--- a/src/providers/krb5/krb5_common.c
+++ b/src/providers/krb5/krb5_common.c
@@ -184,12 +184,13 @@ errno_t check_and_export_options(struct dp_option *opts,
 }
 
 errno_t krb5_try_kdcip(TALLOC_CTX *memctx, struct confdb_ctx *cdb,
-                              const char *conf_path, struct dp_option *opts)
+                       const char *conf_path, struct dp_option *opts,
+                       int opt_id)
 {
     char *krb5_servers = NULL;
     errno_t ret;
 
-    krb5_servers = dp_opt_get_string(opts, KRB5_KDC);
+    krb5_servers = dp_opt_get_string(opts, opt_id);
     if (krb5_servers == NULL) {
         DEBUG(4, ("No KDC found in configuration, trying legacy option\n"));
         ret = confdb_get_string(cdb, memctx, conf_path,
@@ -201,14 +202,15 @@ errno_t krb5_try_kdcip(TALLOC_CTX *memctx, struct confdb_ctx *cdb,
 
         if (krb5_servers != NULL)
         {
-            ret = dp_opt_set_string(opts, KRB5_KDC, krb5_servers);
+            ret = dp_opt_set_string(opts, opt_id, krb5_servers);
             if (ret != EOK) {
                 DEBUG(1, ("dp_opt_set_string failed.\n"));
                 talloc_free(krb5_servers);
                 return ret;
             }
 
-            DEBUG(9, ("Set krb5 server [%s] based on legacy krb5_kdcip option\n"));
+            DEBUG(9, ("Set krb5 server [%s] based on legacy krb5_kdcip option\n",
+                      krb5_servers));
             DEBUG(0, ("Your configuration uses the deprecated option 'krb5_kdcip' "
                       "to specify the KDC. Please change the configuration to use "
                       "the 'krb5_server' option instead."));
@@ -239,7 +241,7 @@ errno_t krb5_get_options(TALLOC_CTX *memctx, struct confdb_ctx *cdb,
 
     /* If there is no KDC, try the deprecated krb5_kdcip option, too */
     /* FIXME - this can be removed in a future version */
-    ret = krb5_try_kdcip(memctx, cdb, conf_path, opts);
+    ret = krb5_try_kdcip(memctx, cdb, conf_path, opts, KRB5_KDC);
     if (ret != EOK) {
         DEBUG(1, ("sss_krb5_try_kdcip failed.\n"));
         goto done;
diff --git a/src/providers/krb5/krb5_common.h b/src/providers/krb5/krb5_common.h
index 9ca0146..a6fdd8b 100644
--- a/src/providers/krb5/krb5_common.h
+++ b/src/providers/krb5/krb5_common.h
@@ -131,7 +131,8 @@ errno_t check_and_export_options(struct dp_option *opts,
                                  struct krb5_ctx *krb5_ctx);
 
 errno_t krb5_try_kdcip(TALLOC_CTX *memctx, struct confdb_ctx *cdb,
-                       const char *conf_path, struct dp_option *opts);
+                       const char *conf_path, struct dp_option *opts,
+                       int opt_id);
 
 errno_t krb5_get_options(TALLOC_CTX *memctx, struct confdb_ctx *cdb,
                          const char *conf_path, struct dp_option **_opts);
diff --git a/src/providers/ldap/ldap_common.c b/src/providers/ldap/ldap_common.c
index 4242a7e..678e75c 100644
--- a/src/providers/ldap/ldap_common.c
+++ b/src/providers/ldap/ldap_common.c
@@ -62,7 +62,7 @@ struct dp_option default_basic_opts[] = {
     { "ldap_krb5_keytab", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "ldap_krb5_init_creds", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
     /* use the same parm name as the krb5 module so we set it only once */
-    { "krb5_kdcip", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "krb5_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "ldap_pwd_policy", DP_OPT_STRING, { "none" }, NULL_STRING },
     { "ldap_referrals", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
@@ -377,6 +377,14 @@ int ldap_get_options(TALLOC_CTX *memctx,
         goto done;
     }
 
+    /* If there is no KDC, try the deprecated krb5_kdcip option, too */
+    /* FIXME - this can be removed in a future version */
+    ret = krb5_try_kdcip(memctx, cdb, conf_path, opts->basic, SDAP_KRB5_KDC);
+    if (ret != EOK) {
+        DEBUG(1, ("sss_krb5_try_kdcip failed.\n"));
+        goto done;
+    }
+
     ret = EOK;
     *_opts = opts;
 
@@ -597,9 +605,9 @@ int sdap_gssapi_init(TALLOC_CTX *mem_ctx,
     const char *krb5_realm;
     struct krb5_service *service = NULL;
 
-    krb5_servers = dp_opt_get_string(opts, SDAP_KRB5_KDCIP);
+    krb5_servers = dp_opt_get_string(opts, SDAP_KRB5_KDC);
     if (krb5_servers == NULL) {
-        DEBUG(1, ("Missing krb5_kdcip option, using service discovery!\n"));
+        DEBUG(1, ("Missing krb5_server option, using service discovery!\n"));
     }
 
     krb5_realm = dp_opt_get_string(opts, SDAP_KRB5_REALM);
diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h
index 5c4f4a5..7fdf26c 100644
--- a/src/providers/ldap/sdap.h
+++ b/src/providers/ldap/sdap.h
@@ -171,7 +171,7 @@ enum sdap_basic_opt {
     SDAP_SASL_AUTHID,
     SDAP_KRB5_KEYTAB,
     SDAP_KRB5_KINIT,
-    SDAP_KRB5_KDCIP,
+    SDAP_KRB5_KDC,
     SDAP_KRB5_REALM,
     SDAP_PWD_POLICY,
     SDAP_REFERRALS,
-- 
1.7.3.2



More information about the sssd-devel mailing list