[SSSD] [PATCH] KRB5: Do not send PAC in server mode

Jakub Hrozek jhrozek at redhat.com
Fri Jul 19 13:04:31 UTC 2013


On Fri, Jul 19, 2013 at 01:46:02PM +0200, Jakub Hrozek wrote:
> The krb5 child contacts the PAC responder for any user except for the IPA
> native users if the PAC is configured. This works fine for the general
> case but the ipa_server_mode is a special one. The PAC responder is there,
> but since in the server mode we should be operating as AD provider default,
> the PAC shouldn't be analyzed either in this case.

I already confused Alexander on IRC, so I should also clarify the path
-- the PAC is not used only during *password auth*. The PAC responder is
still up and running and the PAC is used in case of Kerberos auth.



More information about the sssd-devel mailing list