[SSSD] request for Heimdal support

lists lists at xs4me.net
Thu Dec 22 18:22:56 UTC 2011


Stephen Gallagher schreef op 22.12.2011 13:59:
> On Thu, 2011-12-22 at 11:46 +0100, lists wrote:
>> >
>> >
>> > Thanks, I took a closer look and I think (hope) I fixed the 
>> warnings
>> > and
>> > errors.
>> >
>> > There's one 'gotcha' here. I added a nasty hack to the definition 
>> of
>> > sss_krb5_get_init_creds_opt_set_canonicalize() to work around the
>> > fact
>> > that Heimdal and MIT both define this function with a different 
>> set
>> > of
>> > options. For the moment, I'm just adding an extra check so that it
>> > will
>> > fall back to 'unsupported' until we figure out a way with autoconf 
>> to
>> > check what arguments the function takes.
>> >
>> > I've attached the new version of the patch and pushed it to my
>> > fedorapeople repo as well, on the 'heimdal' branch. You should be
>> > able
>> > to do a 'git pull' to update it.
>>
>> Ok, this seems to work. The only change I had to make was to add
>> check-ticket-addresses = false to my KDC configuration.
>> In the Heimdal based version there is HostAddresses parameter 
>> present
>> that is not there in the MIT based version. (as seen with wireshark)
>>
>> this is what I tested:
>> - getent passwd <ldapuser>
>> - ssh <ldapuser>@localhost
>> - graphical login (user had a ticket after login)
>> all with success.
>>
>> The communication to openldap was sasl based, so sssd was able to 
>> get a
>> ticket and use it to communicate with openldap.
>>
>> Do you have other scenarios/things you want me to test?
>
>
> That's a good start. If possible, I'd like you to test the following
> additional features:
>
> 1) Password-change (using chpass_provider = krb5)
> 2) Expiration warning. Set a user principal's password expiration 
> time
> to less than seven days in the future, then perform an online login 
> at
> the console or SSH and verify that you get a warning message that it
> will expire soon.
> 3) Deferred kinit: set 'cache_credentials = True' and
> 'krb5_store_password_if_offline = True' in sssd.conf and restart 
> SSSD.
> Then perform an offline cached authentication (unplug your network 
> cable
> and log in). Then plug the cable back in. Wait 10-15s and then do a
> klist and verify that your credentials were automatically retrieved 
> once
> SSSD detected that you were back online.
>
> Those are the major features I'd like to have tested. Thank you very
> much for your help!

Here are my test results;
1) I was not able to change passwords. However I do not think it is 
SSSD related.
I was also not able to change passwords via kpasswd. I tried to setup a 
completely new realm but even then I could not change a password via 
kpasswd.
So either I am doing something wrong or it is a bug in Heimdal.

When changing passwords via SSSD, it sends out the same messages to the 
KDC compared to kpasswd.

2) this is working.

3) This is not working.
I am not able to log in when the cable is not connected, only when the 
cable is connected.
I get a segfaul message in the /var/log/messages file:
kernel: krb5_child[14373]: segfault at 0 ip 00007f9ad9655471 sp 
00007fff8d12f2a8 error 4 in libc-2.13.so[7f9ad95d5000+182000]
I will send sssd logging via pm




More information about the sssd-devel mailing list