[SSSD] request for Heimdal support

Jakub Hrozek jhrozek at redhat.com
Thu Dec 22 15:11:06 UTC 2011


On Thu, Dec 22, 2011 at 07:59:39AM -0500, Stephen Gallagher wrote:
> On Thu, 2011-12-22 at 11:46 +0100, lists wrote:
> > >
> > >
> > > Thanks, I took a closer look and I think (hope) I fixed the warnings 
> > > and
> > > errors.
> > >
> > > There's one 'gotcha' here. I added a nasty hack to the definition of
> > > sss_krb5_get_init_creds_opt_set_canonicalize() to work around the 
> > > fact
> > > that Heimdal and MIT both define this function with a different set 
> > > of
> > > options. For the moment, I'm just adding an extra check so that it 
> > > will
> > > fall back to 'unsupported' until we figure out a way with autoconf to
> > > check what arguments the function takes.
> > >
> > > I've attached the new version of the patch and pushed it to my
> > > fedorapeople repo as well, on the 'heimdal' branch. You should be 
> > > able
> > > to do a 'git pull' to update it.
> > 
> > Ok, this seems to work. The only change I had to make was to add 
> > check-ticket-addresses = false to my KDC configuration.
> > In the Heimdal based version there is HostAddresses parameter present 
> > that is not there in the MIT based version. (as seen with wireshark)
> > 
> > this is what I tested:
> > - getent passwd <ldapuser>
> > - ssh <ldapuser>@localhost
> > - graphical login (user had a ticket after login)
> > all with success.
> > 
> > The communication to openldap was sasl based, so sssd was able to get a 
> > ticket and use it to communicate with openldap.
> > 
> > Do you have other scenarios/things you want me to test?
> 
> 
> That's a good start. If possible, I'd like you to test the following
> additional features:
> 
> 1) Password-change (using chpass_provider = krb5)
> 2) Expiration warning. Set a user principal's password expiration time
> to less than seven days in the future, then perform an online login at
> the console or SSH and verify that you get a warning message that it
> will expire soon.
> 3) Deferred kinit: set 'cache_credentials = True' and
> 'krb5_store_password_if_offline = True' in sssd.conf and restart SSSD.
> Then perform an offline cached authentication (unplug your network cable
> and log in). Then plug the cable back in. Wait 10-15s and then do a
> klist and verify that your credentials were automatically retrieved once
> SSSD detected that you were back online.
> 
> Those are the major features I'd like to have tested. Thank you very
> much for your help!

I haven't actually tested the Heimdal support -- I don't have any
distribution that includes Heimdal handy -- but the patch looks good and
as far as I could see it does not break anything.

Ack.



More information about the sssd-devel mailing list