[SSSD] request for Heimdal support

Stephen Gallagher sgallagh at redhat.com
Tue Dec 20 18:42:14 UTC 2011


On Tue, 2011-12-20 at 19:37 +0100, lists wrote:
> Hi,
> 
> Would it be possible to extend SSSD and also support Heimdal as Kerberos
> client implementation?
> 
> This patch seems to provide just that: 
> http://cvs.pld-linux.org/cgi-bin/viewvc.cgi/cvs/packages/sssd/sssd-heimdal.patch?view=markup
> 
> My setup is as follows:
> - server with 
> 	- Heimdal KDC
> 	- openldap 
> 	- pam_ldap / nss_ldap
> 
> - laptops/workstations with
> 	- mit kerberos clients
> 	- SSSD
> 
> I would like to use SSSD on all my machines, but because SSSD does not
> support Heimdal I cannot replace pam_ldap/nss_ldap on the server.
> 
> Maybe you could consider this patch and add it to SSSD? 


Well, this patch as-is won't work (because it disables support for MIT
Kerberos while adding support for Heimdal. We may be able to add support
for choosing the kerberos implementation at build-time.

It's going to be difficult to test for us, however. Most of our
development is done on Fedora, which has no standalone Heimdal package
(this is because MIT kerberos and Heimdal cannot currently coexist on
the same system because they conflict with some files (like libkrb5.so).

I can work up a possible patch, but I'd need you to be able to help test
it. Is that something you'd be willing to work on?

Also, please file an enhancement request at
https://fedorahosted.org/sssd (if you don't have a Fedora login account,
you can get one for free at https://admin.fedoraproject.org/accounts)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111220/3f338dfd/attachment.sig>


More information about the sssd-devel mailing list