[SSSD] [PATCH] Re: Problem limiting etypes to keytab

Stef Walter stefw at gnome.org
Fri Jul 6 17:11:15 UTC 2012


On 07/05/2012 05:21 PM, Stephen Gallagher wrote:
> On Thu, 2012-07-05 at 10:47 +0200, Stef Walter wrote:
>> On 07/04/2012 06:01 PM, Stef Walter wrote:
>>>  1) Rewrite the way we kinit with a keytab. Use krb5_init_creds_init()
>>>     + krb5_init_creds_set_keytab() + krb5_init_creds_get() instead of
>>>     just krb5_get_init_creds_keytab().
>>
>> Hmmm, this doesn't seem to be an option. We don't have access to the
>> krb5_kdc_req member of krb5_init_creds_context from outside of the krb5
>> library.
> 
> 
> We discussed this on a phone call today. The decision we've made is that
> we're going to address this in libkrb5 rather than SSSD. We will
> backport the fix for krb5 1.11.x into the versions carried in RHEL and
> Fedora and recommend that other distributions do the same.
> 
> For this to work properly, we will revert the patch that Stef originally
> committed to SSSD.

Here is a patch which does the revert. I've tested this with the latest
krb5 from git master. Verified that without the revert the (DES related)
corner case is broken, and with the revert the corner case works again.

Cheers,

Stef
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Revert-commit-4c157ecedd52602f75574605ef48d0c48e9bfb.patch
Type: text/x-patch
Size: 8888 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120706/5ccda312/attachment.bin>


More information about the sssd-devel mailing list