[SSSD] [PATCH] Re: Problem limiting etypes to keytab

Stephen Gallagher sgallagh at redhat.com
Fri Jul 6 17:22:25 UTC 2012


On Fri, 2012-07-06 at 19:11 +0200, Stef Walter wrote:
> On 07/05/2012 05:21 PM, Stephen Gallagher wrote:
> > On Thu, 2012-07-05 at 10:47 +0200, Stef Walter wrote:
> >> On 07/04/2012 06:01 PM, Stef Walter wrote:
> >>>  1) Rewrite the way we kinit with a keytab. Use krb5_init_creds_init()
> >>>     + krb5_init_creds_set_keytab() + krb5_init_creds_get() instead of
> >>>     just krb5_get_init_creds_keytab().
> >>
> >> Hmmm, this doesn't seem to be an option. We don't have access to the
> >> krb5_kdc_req member of krb5_init_creds_context from outside of the krb5
> >> library.
> > 
> > 
> > We discussed this on a phone call today. The decision we've made is that
> > we're going to address this in libkrb5 rather than SSSD. We will
> > backport the fix for krb5 1.11.x into the versions carried in RHEL and
> > Fedora and recommend that other distributions do the same.
> > 
> > For this to work properly, we will revert the patch that Stef originally
> > committed to SSSD.
> 
> Here is a patch which does the revert. I've tested this with the latest
> krb5 from git master. Verified that without the revert the (DES related)
> corner case is broken, and with the revert the corner case works again.


I tested a couple basic use-cases. No regressions noted.

Ack and pushed to master.

Please provide a version of this patch that will apply to the sssd-1-8
branch as well.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120706/d01be135/attachment.sig>


More information about the sssd-devel mailing list