[SSSD] Questions about sssd-krb5

David O'Brien davido at redhat.com
Wed May 26 07:20:50 UTC 2010


Stephen Gallagher wrote:
> On 05/24/2010 01:40 AM, David O'Brien wrote:
>> I have a few questions about configuring SSSD to use KRB5
>> authentication, mostly taken from the man page. I've made lots of
>> abbreviations, just leaving in the critical bits. Options with no
>> description are there for a reason.
>>
>> CONFIGURATION OPTIONS
>> "If the auth−module krb5 is used in a SSSD domain,..."
>>    - Is this the same as saying, "If you use Kerberos as your auth provider"?
>>
> 
> Yes, this should be more properly expressed as "auth_provider = krb5"

ok, in this case I'd be more inclined to write, "If you use krb5 as the 
authentication provider in an SSSD domain,..." (rather than using the 
"key=value" format) because the tone of these types of passages is 
slightly more conversational. Here I tend to steer away from "if 
option=value and bool=true then set x=10". Easy to read and understand 
if you deal with it on a daily basis, but I don't think that's the 
primary audience of man pages and definitely not user doc.

> 
>> "... the following options must be used."
>>    - Is krb5_kpasswd an exception to this? That is, if the change
>> password service *is* running on the KDC, then there is no reason or
>> requirement to define alternative servers, right? In the example that I
>> have in the user doc (see bottom of page), isn't this defined as follows:
>>
> 
> This is not a mandatory option. I think we probably want to change that 
> sentence to "the following options MAY be used". There's actually a fair 
> amount of changes we probably need to make to the manpages. I'll try to 
> list the important things below:

Should I wait for the appropriate person to make the required changes to 
the man pages (from a technical perspective) so that I can then review 
them from an English and readability angle? That will also reduce the 
number of times I reproduce errors, etc., in the man pages in the user doc.

Lastly, for all those options with "standard" or "sensible" defaults, 
how do I find out what they are?

thanks a lot
> 
>> chpass_provider = krb5
>> (I'm still getting a handle on this change password provider part)
>>
>> krb5_kdcip (string)
> If left unspecified, DNS service discovery will be used.
> 
>> krb5_realm (string)
> At present, this is mandatory (correct me if I'm wrong, Jakub). In the 
> future, it may be possible to detect this by DNS as well.
> 
>> krb5_changepw_principal (string)
> Has a standard default
> 
>> krb5_kpasswd (string)
>>              If the change password service is not running on the KDC
>> alternative servers can be defined here.
> That "if" clause is misleading. This option forces the use of a 
> different kpasswd service from the KDC. If it's not specified, the KDC 
> is used. It is preferred to always point this at a master kpasswd server 
> (to avoid propagation-delay errors).
> 
>> krb5_ccachedir (string)
> Has a sensible default
> 
>> krb5_ccname_template (string)
> Has a sensible default
> 
>> krb5_auth_timeout (integer)
> Has a sensible default
> 
>> The following three options are included in the man page "must be used"
>> list, but do not appear in the example that I currently have in the user
>> doc (shown at bottom). Should they be?
> 
> None of these are mandatory, as they have defaults.
> 
>> krb5_validate (boolean)
>> krb5_keytab (string)
>> krb5_store_password_if_offline (boolean)
>>
>> ======
>> Current User Doc Example
>>
>> [domain/KRBDOMAIN]
>> enumerate = false
>> id_provider = ldap
>> chpass_provider = krb5
>> ldap_uri = ldap://ldap.mydomain.org
>> ldap_user_search_base = dc=mydomain,dc=org
>> tls_reqcert = demand
>> ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt
>>
>> auth_provider = krb5
>> krb5_kdcip = 192.168.1.1
>> krb5_realm = EXAMPLE.COM
>> krb5_changepw_principal = kadmin/changepw
>> krb5_ccachedir = /tmp
>> krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX
>> krb5_auth_timeout = 15
>>
>> At this point I'll probably head off home and read the next section in
>> my Kerberos book...
>>
>> cheers
>>
> 
> 


-- 

David O'Brien
Senior Technical Writer, Engineering Content Services
Red Hat Asia Pacific Pty Ltd
193 North Quay, Brisbane

"We couldn't care less about comfort. We make you feel good."
Federico Minoli CEO Ducati Motor S.p.A.



More information about the sssd-devel mailing list