[SSSD] Questions about sssd-krb5

David O'Brien davido at redhat.com
Mon May 24 05:40:49 UTC 2010


I have a few questions about configuring SSSD to use KRB5 
authentication, mostly taken from the man page. I've made lots of 
abbreviations, just leaving in the critical bits. Options with no 
description are there for a reason.

CONFIGURATION OPTIONS
"If the auth−module krb5 is used in a SSSD domain,..."
  - Is this the same as saying, "If you use Kerberos as your auth provider"?

"... the following options must be used."
  - Is krb5_kpasswd an exception to this? That is, if the change 
password service *is* running on the KDC, then there is no reason or 
requirement to define alternative servers, right? In the example that I 
have in the user doc (see bottom of page), isn't this defined as follows:

chpass_provider = krb5
(I'm still getting a handle on this change password provider part)

krb5_kdcip (string)
krb5_realm (string)
krb5_changepw_principal (string)
krb5_kpasswd (string)
            If the change password service is not running on the KDC 
alternative servers can be defined here.
krb5_ccachedir (string)
krb5_ccname_template (string)
krb5_auth_timeout (integer)

The following three options are included in the man page "must be used" 
list, but do not appear in the example that I currently have in the user 
doc (shown at bottom). Should they be?

krb5_validate (boolean)
krb5_keytab (string)
krb5_store_password_if_offline (boolean)

======
Current User Doc Example

[domain/KRBDOMAIN]
enumerate = false
id_provider = ldap
chpass_provider = krb5
ldap_uri = ldap://ldap.mydomain.org
ldap_user_search_base = dc=mydomain,dc=org
tls_reqcert = demand
ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt

auth_provider = krb5
krb5_kdcip = 192.168.1.1
krb5_realm = EXAMPLE.COM
krb5_changepw_principal = kadmin/changepw
krb5_ccachedir = /tmp
krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX
krb5_auth_timeout = 15

At this point I'll probably head off home and read the next section in 
my Kerberos book...

cheers

-- 

David O'Brien
Senior Technical Writer, Engineering Content Services
Red Hat Asia Pacific Pty Ltd
193 North Quay, Brisbane

"We couldn't care less about comfort. We make you feel good."
Federico Minoli CEO Ducati Motor S.p.A.



More information about the sssd-devel mailing list