[SSSD] [PATCHES] Add support for multiple servers in the Kerberos locator plugin

Simo Sorce simo at redhat.com
Tue Jul 17 21:46:02 UTC 2012


On Tue, 2012-07-17 at 13:36 -0400, Stephen Gallagher wrote:
> This is the first half of the work necessary to resolve
> https://fedorahosted.org/sssd/ticket/941
> 
> This patch largely rewrites the Kerberos locator plugin so that it can
> parse kdcinfo files containing multiple servers (one per line, with
> optional port). These patches are testable by manually
> editing /var/lib/sss/pubconf/kdcinfo.REALM
> (or /var/lib/sss/pubconf/kpasswdinfo.REALM, as appropriate). They are
> also fully backwards-compatible.
> 
> I will be working on and sending the KRB5 provider side of things after
> this, but since these are ready, manually testable and
> backwards-compatible, it seemed prudent to send them for review in
> parallel.

Is it forward compatible ?
Meaning, if I have an application that already has the old plugin loaded
and you upgrade sssd to start generating multiple lines in the file, how
will the old app behave ?

> Patch 0001: Convert memory allocation functions to use talloc. There's
> no reason to avoid this dependency, and it will make subsequent patches
> much simpler.

Nack,
this code is loaded by libkrb5 and imported into other applications.
Talloc is not thread safe and we do not want to drag this dependency in
random applications unless it is fully thread safe.

> Patch 0002: Create a structure for holding address and port information
> (with linked-list semantics)

Do we really need a complex linked list ?
How many entries do we expect to have ?
Wouldn't a simple array be easier to manage ?

> Patch 0003: Rewrite the kdcinfo parser so that it supports multiple
> entries, one per line. It ignores blank lines.
> Patch 0004: Modify the sssd_krb5_locator_lookup() function to send
> repeated calls to the cbfunc() callback, providing all of the
> kdcinfo-specified servers as values. Clients using libkrb5 will
> transparently try all of the provided servers until finding one that
> works.

Haven't really looked at the rest as the first nack unfortunately means
a lot needs to be changed now.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list