[SSSD] [PATCH] Convert krb5_kdcip option to krb5_server

Stephen Gallagher sgallagh at redhat.com
Thu Oct 14 18:08:25 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/14/2010 03:48 AM, Jan Zelený wrote:
> Stephen Gallagher <sgallagh at redhat.com> wrote:
>> On 09/29/2010 09:09 AM, Jan Zelený wrote:
>>> Stephen Gallagher <sgallagh at redhat.com> wrote:
>>>> On 09/29/2010 07:24 AM, Jan Zelený wrote:
>>>>> Jan Zelený <jzeleny at redhat.com> wrote:
>>>>>> Jan Zelený <jzeleny at redhat.com> wrote:
>>>>>>> Based on Jakub's proof-of-concept patch I prepared a patch which
>>>>>>> handles this option replacement. As it was discussed on the meeting
>>>>>>> couple weeks back, I didn't modify the update script (I hope I
>>>>>>> remember this requirement modification right) and in case both
>>>>>>> krb5_kdcip and krb5_server options are in the config file, the latter
>>>>>>> one has bigger priority.
>>>>>>>
>>>>>>> Jan
>>>>>>
>>>>>> Sorry, wrong patch. Will send the most recent version later today.
>>>>>
>>>>> Here it is.
>>>>>
>>>>> Jan
>>>>
>>>> Nack.
>>>>
>>>> You can't remove krb5_kdcip from SSSDConfig API. It will break existing
>>>> configurations if they run it through authconfig. (SSSDConfig API will
>>>> throw an exception on the unknown value).
>>>>
>>>> If I'm reading this right, a user is going to see the deprecation error
>>>> message if they have neither krb5_kdcip nor krb5_server specified. This
>>>> is a bug, since if neither is specified, we use service discovery.
>>>>
>>>> confdb_get_string will return EOK and set krb5_servers to NULL if
>>>> krb5_kdcip is not found. You should handle this case accordingly.
>>>
>>> I'm sending an updated version. I left SSSDConfigTest.py unchanged, it
>>> should do the testing on the new values.
>>
>> Nack. Please update SSSDConfigTest.py so that the tests do not fail.
> 
> I'm not 100% sure my approach is the right one, but I've corrected the script 
> and it doesn't fail any more.
> 

Ack, with one minor change (in the attached patch).

Purely for aesthetic reasons, I moved krb5_kdcip into the control lists,
instead of adding an extra .extend() call for them.


- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAky3RxkACgkQeiVVYja6o6MBzACffpIUbJgVH0PUixx4eZ9MP+MZ
0csAoI0HR6JqvjyTinKibv9R55m3U7k1
=7Iws
-----END PGP SIGNATURE-----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Option-krb5_server-is-now-used-to-store-a-list-of-KD.patch
Type: text/x-patch
Size: 13789 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20101014/c4c02fda/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Option-krb5_server-is-now-used-to-store-a-list-of-KD.patch.sig
Type: application/pgp-signature
Size: 72 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20101014/c4c02fda/attachment.sig>


More information about the sssd-devel mailing list