[SSSD] request for Heimdal support

Stephen Gallagher sgallagh at redhat.com
Wed Dec 21 12:37:26 UTC 2011


On Wed, 2011-12-21 at 11:40 +0100, lists wrote:
> Stephen Gallagher schreef op 20.12.2011 22:20:
> > On Tue, 2011-12-20 at 19:54 +0100, lists wrote:
> >> Stephen Gallagher schreef op di 20-12-2011 om 13:42 [-0500]:
> >> > On Tue, 2011-12-20 at 19:37 +0100, lists wrote:
> >> > > Hi,
> >> > >
> >> > > Would it be possible to extend SSSD and also support Heimdal as 
> >> Kerberos
> >> > > client implementation?
> >> > >
> >> > > This patch seems to provide just that:
> >> > > 
> >> http://cvs.pld-linux.org/cgi-bin/viewvc.cgi/cvs/packages/sssd/sssd-heimdal.patch?view=markup
> >> > >
> >> > > My setup is as follows:
> >> > > - server with
> >> > > 	- Heimdal KDC
> >> > > 	- openldap
> >> > > 	- pam_ldap / nss_ldap
> >> > >
> >> > > - laptops/workstations with
> >> > > 	- mit kerberos clients
> >> > > 	- SSSD
> >> > >
> >> > > I would like to use SSSD on all my machines, but because SSSD 
> >> does not
> >> > > support Heimdal I cannot replace pam_ldap/nss_ldap on the 
> >> server.
> >> > >
> >> > > Maybe you could consider this patch and add it to SSSD?
> >> >
> >> >
> >> > Well, this patch as-is won't work (because it disables support for 
> >> MIT
> >> > Kerberos while adding support for Heimdal. We may be able to add 
> >> support
> >> > for choosing the kerberos implementation at build-time.
> >> >
> >> > It's going to be difficult to test for us, however. Most of our
> >> > development is done on Fedora, which has no standalone Heimdal 
> >> package
> >> > (this is because MIT kerberos and Heimdal cannot currently coexist 
> >> on
> >> > the same system because they conflict with some files (like 
> >> libkrb5.so).
> >> >
> >> > I can work up a possible patch, but I'd need you to be able to 
> >> help test
> >> > it. Is that something you'd be willing to work on?
> >> That would be great. I can help to test it. I will also file an
> >> enhancement request.
> >
> > Ok, I've got a first-pass of the Heimdal compatibility layer. I've
> > attached the patch (which applies cleanly on the current master). You
> > could also clone my public git repo at
> > git://fedorapeople.org/home/fedora/sgallagh/public_git/sssd.git
> > and then 'git checkout heimdal'.
> >
> > You can then build with 'autoreconf -if && ./configure [appropriate
> > distro flags] && make'
> >
> > (Then finally, 'make install' as root).
> 
> I used the git route. My distro is gentoo, and I am using Heimdal 
> 1.4.1.
> 
> This is what I used as configure command;
> ./configure --prefix=/usr --build=x86_64-pc-linux-gnu 
> --host=x86_64-pc-linux-gnu --mandir=/usr/share/man 
> --infodir=/usr/share/info --datadir=/usr/share --sysconfdir=/etc 
> --localstatedir=/var/lib --libdir=/usr/lib64 
> --disable-dependency-tracking --localstatedir=/var 
> --enable-nsslibdir=/lib64 --with-plugin-path=/usr/lib64/sssd 
> --enable-pammoddir=//lib64/security 
> --with-ldb-lib-dir=/usr/lib64/ldb/modules/ldb --without-nscd 
> --with-unicode-lib=libunistring --without-selinux --without-semanage 
> --without-python-bindings --enable-krb5-locator-plugin --enable-nls 
> --without-libnl

> and configure asks me to report this:
> ....
> checking for pcre_compile in -lpcre... yes
> checking for krb5-config... /usr/bin/krb5-config
> checking for working krb5-config... yes
> checking krb5.h usability... yes
> checking krb5.h presence... yes
> checking for krb5.h... yes
> checking krb5/krb5.h usability... no
> checking krb5/krb5.h presence... no
> checking for krb5/krb5.h... no
> checking for krb5_ticket_times... no
> checking for krb5_times... yes
> checking for krb5_get_init_creds_opt_alloc... yes
> checking for krb5_get_error_message... yes
> checking for krb5_free_unparsed_name... yes
> checking for krb5_get_init_creds_opt_set_expire_callback... no
> checking for krb5_get_init_creds_opt_set_fast_ccache_name... no
> checking for krb5_get_init_creds_opt_set_fast_flags... no
> checking for krb5_get_init_creds_opt_set_canonicalize... yes
> checking for krb5_unparse_name_flags... yes
> checking for krb5_get_init_creds_opt_set_change_password_prompt... no
> checking for krb5_free_keytab_entry_contents... no
> checking for krb5_kt_free_entry... yes
> checking for krb5_princ_realm... yes
> checking for krb5_get_time_offsets... no
> checking for krb5_principal_get_realm... yes
> checking krb5/locate_plugin.h usability... no
> checking krb5/locate_plugin.h presence... yes
> configure: WARNING: krb5/locate_plugin.h: present but cannot be 
> compiled
> configure: WARNING: krb5/locate_plugin.h:     check for missing 
> prerequisite headers?
> configure: WARNING: krb5/locate_plugin.h: see the Autoconf 
> documentation
> configure: WARNING: krb5/locate_plugin.h:     section "Present But 
> Cannot Be Compiled"
> configure: WARNING: krb5/locate_plugin.h: proceeding with the 
> compiler's result
> configure: WARNING:     ## 
> ------------------------------------------------ ##
> configure: WARNING:     ## Report this to 
> sssd-devel at lists.fedorahosted.org ##
> configure: WARNING:     ## 
> ------------------------------------------------ ##
> checking for krb5/locate_plugin.h... no
> configure: Kerberos locator plugin cannot be build
> checking ares.h usability... yes

This looks like a bug in your Heimdal package. The locator plugin header
can't be compiled. I suggest removing the --enable-krb5-locator-plugin
argument from configure and trying without it.

The locator plugin is there to ensure that non-SSSD kerberized
applications will always talk to the same KDC/kadmin server that SSSD is
currently using. Without it, you need to make sure that krb5.conf is
configured correctly. Then your kerberized apps will EACH make their own
decision as to which KDC to talk to (rather than asking SSSD which one
to use).
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111221/7606340d/attachment.sig>


More information about the sssd-devel mailing list