[SSSD] [PATCH] Look up trusted users directly with AD ID calls if IPA server mode is on

Jakub Hrozek jhrozek at redhat.com
Fri Jun 28 19:07:24 UTC 2013


On Fri, Jun 28, 2013 at 06:43:48PM +0200, Jakub Hrozek wrote:
> Hi,
> 
> the attached patches implement
> https://fedorahosted.org/sssd/ticket/1962. When a new option,
> ipa_server_mode is set to True, then subdomain/trusted users are not
> looked up using the extop plugin but AD ID context is initialized and
> the users are looked up directly with AD code. This is in support of
> legacy clients looking up trusted AD users and groups.

I forgot to add that until FreeIPA gains the ability to attach PAC to
the TGT you obtain you need to use a keytab from AD to auth with AD.
Attached is a simple patch (just for demo purposes) that I used during
my testing.
-------------- next part --------------
>From 59d64e2d817cc27b52454818085e501bf136a9ed Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Wed, 19 Jun 2013 10:58:27 +0200
Subject: [PATCH] NOPUSH: Hardcode the AD keytab and host name for testing

---
 src/providers/ad/ad_common.c       | 7 +++++++
 src/providers/ipa/ipa_subdomains.c | 2 ++
 2 files changed, 9 insertions(+)

diff --git a/src/providers/ad/ad_common.c b/src/providers/ad/ad_common.c
index e457d5285dd71f6814a727a1fea7c468faa8fd3c..c2ace5c6672525c6ef5caae8e1f388b4e04f953f 100644
--- a/src/providers/ad/ad_common.c
+++ b/src/providers/ad/ad_common.c
@@ -147,6 +147,13 @@ ad_create_default_options(TALLOC_CTX *mem_ctx,
         return NULL;
     }
 
+    ret = dp_opt_set_string(ad_options->basic, AD_KEYTAB, "/root/tuser.keytab");
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, ("Cannot set AD keytab\n"));
+        talloc_free(ad_options);
+        return NULL;
+    }
+
     ret = ad_set_ad_id_options(ad_options, ad_options->id);
     if (ret != EOK) {
         talloc_free(ad_options);
diff --git a/src/providers/ipa/ipa_subdomains.c b/src/providers/ipa/ipa_subdomains.c
index 788346aa22fd0b59a4e1bd69990f8aa10a5e11d2..66bbca29e4563ab22139127ef616936e17346dff 100644
--- a/src/providers/ipa/ipa_subdomains.c
+++ b/src/providers/ipa/ipa_subdomains.c
@@ -1248,12 +1248,14 @@ int ipa_ad_subdom_init(struct be_ctx *be_ctx,
         DEBUG(SSSDBG_CRIT_FAILURE, ("No Kerberos realm for IPA?\n"));
         return EINVAL;
     }
+    realm = "AD.EXAMPLE.COM";
 
     hostname = dp_opt_get_string(id_ctx->ipa_options->basic, IPA_HOSTNAME);
     if (hostname == NULL) {
         DEBUG(SSSDBG_CRIT_FAILURE, ("No host name for IPA?\n"));
         return EINVAL;
     }
+    hostname = "tuser at AD.EXAMPLE.COM";
 
     id_ctx->server_mode = talloc(id_ctx, struct ipa_server_mode_ctx);
     if (id_ctx->server_mode == NULL) {
-- 
1.8.3.1



More information about the sssd-devel mailing list