[SSSD] [PATCH] IPA: Detect nsupdate support for the realm directive

Stephen Gallagher sgallagh at redhat.com
Fri Jan 13 15:03:56 UTC 2012


On Fri, 2012-01-13 at 09:50 -0500, Stephen Gallagher wrote:
> Some older platforms (such as RHEL 5) do not support the 'realm'
> directive in nsupdate messages. As a result, dynamic DNS update support
> doesn't work properly on those systems.
> 
> The 'realm' directive was added to remove ambiguity in systems where
> multiple Kerberos realms were in use. It is there to account for cases
> where a default realm has not been specified in /etc/krb5.conf.
> 
> With this patch, we will auto-detect at configure time whether nsupdate
> has 'realm' support or not. If it does not, we will leave it out of the
> update message. The user will need to manually set a default realm
> in /etc/krb5.conf in order to avoid any potential issues with GSSAPI.
> 
> It was originally suggested on IRC that we should make this an option we
> pass to configure, but I don't really see any value in that. I think the
> auto-detection is more reliable in this case.

Sorry, I forgot to note in my original email that this addresses
https://fedorahosted.org/sssd/ticket/1138 and I attached patches for
both master and sssd-1-5 (they differ only by the debug level
specifications)

I have not directly tested these patches, but I have asked the original
reporter of the bug to do so and provided him with a scratch build. I
will include the results of those tests when they are available.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120113/318beb41/attachment.sig>


More information about the sssd-devel mailing list