[SSSD] [PATCH] Add Winbind provider.
Marko Myllynen
myllynen at redhat.com
Mon Nov 14 12:15:12 UTC 2011
Hi,
>>> SSSD configuration option for the Winbind provider can be found in
>>> /etc/sssd/sssd.api.d/sssd-winbind.conf. The correspond pretty much to
>>> Winbind options normally found in smb.conf.
>>
>> I looked at the configuration options provided and I think some
>> additions might be helpful.
>>
>> It should be possible to adjust "client ldap sasl wrapping", "ldap ssl",
>> and "ldap ssl ads". "ldap debug level" probably not needed.
>
> Are you sure the ldap options are used by winbind?
yes, with ldap ssl = start tls / ldap ssl ads = yes winbindd will try to
use StartTLS. client ldap sasl wrapping affects to all users of the the
libads code in Samba (which are net client utility mostly).
>> Not sure would "winbind use default domain = yes" be useful / possible.
>> Same for "create krb5 conf = no".
>
> I think most, if not all, comments are valid. But the idea was to have a
> basic sssd winbind provider as an experimental feature in the sssd
> master branch and add more features over time. Would you mind to open an
> enhancement ticket in trac and add your comments there?
Sure. I created two tickets, the first one should be pretty
straightforward, it's just about adding configuration options not
needing any additional SSSD/Winbind logic:
https://fedorahosted.org/sssd/ticket/1084
And the other for options which might require some additional logic
(e.g., template shell vs allowed_shells/vetoed_shells/shell_fallback):
https://fedorahosted.org/sssd/ticket/1085
FWIW, those who are testing the Winbind backend and joining a machine to
a 2008R2 domain should be probably aware that currently Samba does not
provide AES keys causing issues with krb5, I've recently filed these BZs
about the issue:
https://bugzilla.redhat.com/show_bug.cgi?id=748407
https://bugzilla.redhat.com/show_bug.cgi?id=748528
Cheers,
--
Marko Myllynen
More information about the sssd-devel
mailing list