[SSSD] [PATCH] A new option krb5_use_kdcinfo

Jakub Hrozek jhrozek at redhat.com
Mon Jun 10 19:14:22 UTC 2013


On Mon, Jun 10, 2013 at 02:05:07PM +0200, Ondrej Kos wrote:
> On 06/09/2013 01:56 PM, Jakub Hrozek wrote:
> >In order to test this patch, configure a domain that uses Kerberos (IPA
> >for example) and set krb5_use_kdcinfo=False. Without this option a
> >kdcinfo file (located in /var/lib/sss/pubconf) will be created at login
> >time at latest.
> >
> >With the option set to False, the kdcinfo file will not get created and
> >also you would need to configure your realm in krb5.conf in order for
> >logins to work.
> >
> >https://fedorahosted.org/sssd/ticket/1883
> >
> >The patch introduces a new Kerberos provider option called
> >krb5_use_kdcinfo. The option is true by default in all providers. When
> >set to false, the SSSD will not create krb5 info files that the locator
> >plugin consumes and the user would have to set up the Kerberos options
> >manually in krb5.conf
> >
> >
> >
> >_______________________________________________
> >sssd-devel mailing list
> >sssd-devel at lists.fedorahosted.org
> >https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> >
> 
> Hi,
> 
> Tested with following scenarios against IPA server (F19):
>                                    login     kdcinfo present?
> - not configured krb5.conf
>  - krb5_use_kdcinfo = false        FAIL      NO
>  - krb5_use_kdcinfo = true         PASS      YES
> - configured krb5.conf
>  - krb5_use_kdcinfo = false        PASS      NO
>  - krb5_use_kdcinfo = true         PASS      YES
> 
> Everything works as expected, logs are clean, code-wise the patch looks good
> to me, so *ACK*
> 
> Ondra

Thank you for the review and testing. 

Pushed to master.



More information about the sssd-devel mailing list