[SSSD] [PATCH] A new option krb5_use_kdcinfo
Jakub Hrozek
jhrozek at redhat.com
Mon Jun 10 19:14:22 UTC 2013
On Mon, Jun 10, 2013 at 02:05:07PM +0200, Ondrej Kos wrote:
> On 06/09/2013 01:56 PM, Jakub Hrozek wrote:
> >In order to test this patch, configure a domain that uses Kerberos (IPA
> >for example) and set krb5_use_kdcinfo=False. Without this option a
> >kdcinfo file (located in /var/lib/sss/pubconf) will be created at login
> >time at latest.
> >
> >With the option set to False, the kdcinfo file will not get created and
> >also you would need to configure your realm in krb5.conf in order for
> >logins to work.
> >
> >https://fedorahosted.org/sssd/ticket/1883
> >
> >The patch introduces a new Kerberos provider option called
> >krb5_use_kdcinfo. The option is true by default in all providers. When
> >set to false, the SSSD will not create krb5 info files that the locator
> >plugin consumes and the user would have to set up the Kerberos options
> >manually in krb5.conf
> >
> >
> >
> >_______________________________________________
> >sssd-devel mailing list
> >sssd-devel at lists.fedorahosted.org
> >https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> >
>
> Hi,
>
> Tested with following scenarios against IPA server (F19):
> login kdcinfo present?
> - not configured krb5.conf
> - krb5_use_kdcinfo = false FAIL NO
> - krb5_use_kdcinfo = true PASS YES
> - configured krb5.conf
> - krb5_use_kdcinfo = false PASS NO
> - krb5_use_kdcinfo = true PASS YES
>
> Everything works as expected, logs are clean, code-wise the patch looks good
> to me, so *ACK*
>
> Ondra
Thank you for the review and testing.
Pushed to master.
More information about the sssd-devel
mailing list