[SSSD] [PATCH] A new option krb5_use_kdcinfo

Ondrej Kos okos at redhat.com
Mon Jun 10 12:05:07 UTC 2013


On 06/09/2013 01:56 PM, Jakub Hrozek wrote:
> In order to test this patch, configure a domain that uses Kerberos (IPA
> for example) and set krb5_use_kdcinfo=False. Without this option a
> kdcinfo file (located in /var/lib/sss/pubconf) will be created at login
> time at latest.
>
> With the option set to False, the kdcinfo file will not get created and
> also you would need to configure your realm in krb5.conf in order for
> logins to work.
>
> https://fedorahosted.org/sssd/ticket/1883
>
> The patch introduces a new Kerberos provider option called
> krb5_use_kdcinfo. The option is true by default in all providers. When
> set to false, the SSSD will not create krb5 info files that the locator
> plugin consumes and the user would have to set up the Kerberos options
> manually in krb5.conf
>
>
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>

Hi,

Tested with following scenarios against IPA server (F19):
                                    login     kdcinfo present?
- not configured krb5.conf
  - krb5_use_kdcinfo = false        FAIL      NO
  - krb5_use_kdcinfo = true         PASS      YES
- configured krb5.conf
  - krb5_use_kdcinfo = false        PASS      NO
  - krb5_use_kdcinfo = true         PASS      YES

Everything works as expected, logs are clean, code-wise the patch looks 
good to me, so *ACK*

Ondra

-- 
Ondrej Kos
Associate Software Engineer
Identity Management - SSSD
Red Hat Czech



More information about the sssd-devel mailing list