[SSSD] [PATCH] Allow krb5_realm to override ipa_domain

Sumit Bose sbose at redhat.com
Tue Feb 22 11:13:21 UTC 2011


On Mon, Feb 21, 2011 at 02:04:52PM -0500, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 02/21/2011 11:45 AM, Stephen Gallagher wrote:
> > On 02/21/2011 11:34 AM, Stephen Gallagher wrote:
> >> It is possible to set up FreeIPA servers where the Kerberos realm
> >> differs from the IPA domain name. We need to allow setting the
> >> krb5_realm explicitly to handle this.
> > 
> >> Fixes https://bugzilla.redhat.com/show_bug.cgi?id=679082
> > 
> > 
> > 
> > Withdrawing this patch. I just realized it's incomplete.
> > 
> 
> Un-withdrawing this patch (re-attaching for posterity).
> 
> I thought we were not honoring krb5_realm elsewhere, because we were
> just doing dp_get_option(KRB5_REALM), but I discovered that
> ipa_get_id_options() and ipa_get_auth_options() forcibly sets these
> values to be correct.
> 
> So the only piece that was incorrect was ipa_service_init() (which only
> uses the realm for writing the krb5info file.
> 

ACK

bye,
Sumit

> - -- 
> Stephen Gallagher
> RHCE 804006346421761
> 
> Delivering value year after year.
> Red Hat ranks #1 in value among software vendors.
> http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
> 
> iEYEARECAAYFAk1it1QACgkQeiVVYja6o6Nv3wCgks31OXyxAv/MrxtkOHN9r1aA
> X1MAoK1o9rzXKtRw3miVh1HGCdQwc9zp
> =Q3fi
> -----END PGP SIGNATURE-----



More information about the sssd-devel mailing list