[SSSD] request for Heimdal support

lists lists at xs4me.net
Thu Dec 22 10:46:24 UTC 2011


>
>
> Thanks, I took a closer look and I think (hope) I fixed the warnings 
> and
> errors.
>
> There's one 'gotcha' here. I added a nasty hack to the definition of
> sss_krb5_get_init_creds_opt_set_canonicalize() to work around the 
> fact
> that Heimdal and MIT both define this function with a different set 
> of
> options. For the moment, I'm just adding an extra check so that it 
> will
> fall back to 'unsupported' until we figure out a way with autoconf to
> check what arguments the function takes.
>
> I've attached the new version of the patch and pushed it to my
> fedorapeople repo as well, on the 'heimdal' branch. You should be 
> able
> to do a 'git pull' to update it.

Ok, this seems to work. The only change I had to make was to add 
check-ticket-addresses = false to my KDC configuration.
In the Heimdal based version there is HostAddresses parameter present 
that is not there in the MIT based version. (as seen with wireshark)

this is what I tested:
- getent passwd <ldapuser>
- ssh <ldapuser>@localhost
- graphical login (user had a ticket after login)
all with success.

The communication to openldap was sasl based, so sssd was able to get a 
ticket and use it to communicate with openldap.

Do you have other scenarios/things you want me to test?








More information about the sssd-devel mailing list