[SSSD] request for Heimdal support

Stephen Gallagher sgallagh at redhat.com
Thu Dec 22 15:38:27 UTC 2011


On Thu, 2011-12-22 at 16:11 +0100, Jakub Hrozek wrote:
> On Thu, Dec 22, 2011 at 07:59:39AM -0500, Stephen Gallagher wrote:
> > On Thu, 2011-12-22 at 11:46 +0100, lists wrote:
> > > >
> > > >
> > > > Thanks, I took a closer look and I think (hope) I fixed the warnings 
> > > > and
> > > > errors.
> > > >
> > > > There's one 'gotcha' here. I added a nasty hack to the definition of
> > > > sss_krb5_get_init_creds_opt_set_canonicalize() to work around the 
> > > > fact
> > > > that Heimdal and MIT both define this function with a different set 
> > > > of
> > > > options. For the moment, I'm just adding an extra check so that it 
> > > > will
> > > > fall back to 'unsupported' until we figure out a way with autoconf to
> > > > check what arguments the function takes.
> > > >
> > > > I've attached the new version of the patch and pushed it to my
> > > > fedorapeople repo as well, on the 'heimdal' branch. You should be 
> > > > able
> > > > to do a 'git pull' to update it.
> > > 
> > > Ok, this seems to work. The only change I had to make was to add 
> > > check-ticket-addresses = false to my KDC configuration.
> > > In the Heimdal based version there is HostAddresses parameter present 
> > > that is not there in the MIT based version. (as seen with wireshark)
> > > 
> > > this is what I tested:
> > > - getent passwd <ldapuser>
> > > - ssh <ldapuser>@localhost
> > > - graphical login (user had a ticket after login)
> > > all with success.
> > > 
> > > The communication to openldap was sasl based, so sssd was able to get a 
> > > ticket and use it to communicate with openldap.
> > > 
> > > Do you have other scenarios/things you want me to test?
> > 
> > 
> > That's a good start. If possible, I'd like you to test the following
> > additional features:
> > 
> > 1) Password-change (using chpass_provider = krb5)
> > 2) Expiration warning. Set a user principal's password expiration time
> > to less than seven days in the future, then perform an online login at
> > the console or SSH and verify that you get a warning message that it
> > will expire soon.
> > 3) Deferred kinit: set 'cache_credentials = True' and
> > 'krb5_store_password_if_offline = True' in sssd.conf and restart SSSD.
> > Then perform an offline cached authentication (unplug your network cable
> > and log in). Then plug the cable back in. Wait 10-15s and then do a
> > klist and verify that your credentials were automatically retrieved once
> > SSSD detected that you were back online.
> > 
> > Those are the major features I'd like to have tested. Thank you very
> > much for your help!
> 
> I haven't actually tested the Heimdal support -- I don't have any
> distribution that includes Heimdal handy -- but the patch looks good and
> as far as I could see it does not break anything.
> 
> Ack.

Pushed to master
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111222/b837c650/attachment.sig>


More information about the sssd-devel mailing list