[SSSD] [PATCHES] Run PAC responder and subdomains provider for IPA domains
Jakub Hrozek
jhrozek at redhat.com
Tue Nov 13 16:23:13 UTC 2012
On Tue, Nov 13, 2012 at 01:43:25PM +0100, Sumit Bose wrote:
> Hi,
>
> the following two patches fix https://fedorahosted.org/sssd/ticket/1613
> by running the PAC responder and the subdomains provider for an IPA
> domain with being explicitly configured, i.e. the sssd.conf file
> created by ipa-client-install does not have to be changed if trusts are
> enabled in the server. Please see commit messages for further details.
>
> bye,
> Sumit
Hi,
The functionality seems to be working as expected for both a client enrolled
with an IPA server with trusts and without. I only have a couple of comments:
Maybe it would be nice to split the first patch into two - one that
includes the new functions add_string_to_list and string_in_list and one
that uses them in monitor. I don't require this change, though.
Given that the pac responder is only compiled on systems with reasonably
new libkrb5, I think the pac service should only be added for
configurations that have the pac service compiled in.
Is there a way to disable the automatic enabling of pac responder for
environments that only want to run the minimal required set of services?
Maybe we could have a separate ticket to not spawn pac responder if the
subdomains_provider is explicitly set to none. This doesn't block
inclusion of new patches either.
There is a compilation warning:
src/monitor/monitor.c: In function ‘add_implicit_services’:
src/monitor/monitor.c:855:5: warning: passing argument 2 of
‘string_in_list’ from incompatible pointer type [enabled by default]
In file included from src/monitor/monitor.c:22:0:
./src/util/util.h:542:6: note: expected ‘const char **’ but argument is
of type ‘char **’
I asked our docs expert to check the man page paragraph in the second
patch, here is what she proposed:
+ <refsect1 id='subdomains_provider'>
+ <title>SUBDOMAINS PROVIDER</title>
+ <para>
+ The IPA subdomains provider behaves slightly differently
+ if it is configured explicitly or implicitly.
+ </para>
+ <para>
+ If the option 'subdomains_provider = ipa' is found in the
+ domain section of sssd.conf, the IPA subdomains provider is
+ configured explicitly, and all subdomain requests are sent to the
+ IPA server if necessary.
+ </para>
+ <para>
+ If the option 'subdomains_provider' is not set in the domain
+ section of sssd.conf but there is the option 'id_provider = ipa,' the IPA subdomains
+ provider is configured implictly. In this case, if a subdomain
+ request fails and indicates that the server does not support
+ subdomains, i.e. is not configured for trusts, the IPA subdomains
+ provider is disabled. After an hour or after the IPA provider goes
+ online, the subdomains provider is enabled again.
+ </para>
+ </refsect1>
More information about the sssd-devel
mailing list