[SSSD] [PATCH] Add support to request canonicalization on krb AS requests

Jakub Hrozek jhrozek at redhat.com
Thu Oct 20 10:07:43 UTC 2011


On Thu, Oct 20, 2011 at 10:48:08AM +0200, Jan Zelený wrote:
> https://fedorahosted.org/sssd/ticket/957
> 
> Jan

Nack:

Please fix the unittests. 

The new option needs to be added to the sss-krb5 man page.

I think it would make sense to rebase this patch on top of "[PATCH] Add
krb5_fast_principal to SSSDConfig API".

If you're staying with the env variable and not doing the command line
options as Sumit suggested, then it's easier and less error prone to just
check if the env variable is set to anything:

    tmp_str = getenv(SSSD_KRB5_CANONICALIZE);
    if (tmp_str) {
        set_canonicalize();
    }

Maybe it would be nicer to wrap the above in a function to avoid
duplication.

Does it make sense to pass the option to the LDAP child as well?

I'm not sure if we still plan to support old Kerberos libraries,
such as RHEL5 with SSSD 1.7.0+ but if we do, you also need to create
a wrapper around krb5_get_init_creds_opt_set_canonicalize(). See
sss_krb5_get_init_creds_opt_set_expire_callback() for an example.



More information about the sssd-devel mailing list