[SSSD] new ldap users inconsistently able to auth on existing servers

Stephen Gallagher sgallagh at redhat.com
Tue Jun 28 12:18:08 UTC 2011


On Tue, 2011-06-28 at 00:40 -0400, Johnny Tan wrote:
> On Fri, Jun 24, 2011 at 2:19 PM, Stephen Gallagher <sgallagh at redhat.com> wrote:
> > On Fri, 2011-06-24 at 14:15 -0400, Johnny Tan wrote:
> >> On Wed, Jun 22, 2011 at 8:59 AM, Jeff Schroeder
> >> <jeffschroeder at computer.org> wrote:
> >> >> What's the exact version I should be looking for? Whether it's shipped
> >> >> with the 5.7-BETA or even a later one that is recommended. I'm
> >> >> thinking if I dig around and find the most recent possible srpm and
> >> >> then drop the latest maintenance tarball in there, I could do an rpm
> >> >> rebuild of it.
> >> >
> >> > You might try sssd-1.5.1-34.el6_1.1.src.rpm from:
> >> > http://ftp.scientificlinux.org/linux/scientific/6rolling/source/SRPMS/vendor/
> >> >
> >> > You might need to update a couple of packages in a local mock
> >> > repository, but it is easy to do, I've done it with the Fedora sssd
> >> > packages from Koji.
> >>
> >> Hi Jeff:
> >>
> >> Would you happen to have notes from this rpm rebuild on Centos-5?
> >>
> >> I started down the path. For sssd, the requirement for krb5 >= 1.9 has
> >> led me down a long path of dependencies.
> >>
> >> For openldap24, similarly long path of dependencies.
> >
> > The requirement for krb5 >= 1.9 is only for RHEL6. You can change that
> > to just krb5 if you extract the specfile from the SRPM.
> >
> > Similarly, you don't NEED to build against openldap24.
> >
> > So the following should work:
> >
> > rpm2cpio sssd-1.5.1-34.el6_1.1.src.rpm |cpio --extract
> > Edit sssd.spec to remove the versioned requirement from krb5.
> > rpmbuild -ba sssd.spec
> 
> D'oh! Wish I had started out that way, would've saved a couple days.
> 
> It still took a bit of trial and error. I ended up having to add these
> two lines to the spec file between %build and %configure:
> 
> autopoint -f
> aclocal -I m4 -I .
> 
> Otherwise, the @MKINSTALLDIRS@ substitutions would not occur in the
> po/Makefile* files.
> 
> I am now up & running on 1.5.1-34! And, indeed, it has solved the
> problem with inconsistent logins.


Ah, sorry. I forgot that RHEL 5 needs a little love there. What you
really want to do (to be perfectly safe) is this:

%build
# RHEL 5 uses an old libtool, so we need to reconfigure
for i in libtool.m4  lt~obsolete.m4  ltoptions.m4  ltsugar.m4
ltversion.m4
do
    find . -name $i -exec rm -f {} \;
done

autoreconf -ivf

%configure \
    --with-db-path=%{dbpath} \
    --with-pipe-path=%{pipepath} \
    --with-pubconf-path=%{pubconfpath} \
    --with-init-dir=%{_initrddir} \
    --enable-nsslibdir=/%{_lib} \
    --enable-pammoddir=/%{_lib}/security \
    --disable-static \
    --disable-rpath \
    --with-test-dir=/dev/shm


That way you can run autoreconf which will update all of the correct
autotool settings.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110628/edb3c93b/attachment.sig>


More information about the sssd-devel mailing list