[SSSD] request for Heimdal support

Stephen Gallagher sgallagh at redhat.com
Thu Dec 22 12:59:39 UTC 2011


On Thu, 2011-12-22 at 11:46 +0100, lists wrote:
> >
> >
> > Thanks, I took a closer look and I think (hope) I fixed the warnings 
> > and
> > errors.
> >
> > There's one 'gotcha' here. I added a nasty hack to the definition of
> > sss_krb5_get_init_creds_opt_set_canonicalize() to work around the 
> > fact
> > that Heimdal and MIT both define this function with a different set 
> > of
> > options. For the moment, I'm just adding an extra check so that it 
> > will
> > fall back to 'unsupported' until we figure out a way with autoconf to
> > check what arguments the function takes.
> >
> > I've attached the new version of the patch and pushed it to my
> > fedorapeople repo as well, on the 'heimdal' branch. You should be 
> > able
> > to do a 'git pull' to update it.
> 
> Ok, this seems to work. The only change I had to make was to add 
> check-ticket-addresses = false to my KDC configuration.
> In the Heimdal based version there is HostAddresses parameter present 
> that is not there in the MIT based version. (as seen with wireshark)
> 
> this is what I tested:
> - getent passwd <ldapuser>
> - ssh <ldapuser>@localhost
> - graphical login (user had a ticket after login)
> all with success.
> 
> The communication to openldap was sasl based, so sssd was able to get a 
> ticket and use it to communicate with openldap.
> 
> Do you have other scenarios/things you want me to test?


That's a good start. If possible, I'd like you to test the following
additional features:

1) Password-change (using chpass_provider = krb5)
2) Expiration warning. Set a user principal's password expiration time
to less than seven days in the future, then perform an online login at
the console or SSH and verify that you get a warning message that it
will expire soon.
3) Deferred kinit: set 'cache_credentials = True' and
'krb5_store_password_if_offline = True' in sssd.conf and restart SSSD.
Then perform an offline cached authentication (unplug your network cable
and log in). Then plug the cable back in. Wait 10-15s and then do a
klist and verify that your credentials were automatically retrieved once
SSSD detected that you were back online.

Those are the major features I'd like to have tested. Thank you very
much for your help!
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111222/0250ce01/attachment.sig>


More information about the sssd-devel mailing list