[SSSD] [PATCH] Look up trusted users directly with AD ID calls if IPA server mode is on
Jakub Hrozek
jhrozek at redhat.com
Fri Jun 28 19:07:24 UTC 2013
On Fri, Jun 28, 2013 at 06:43:48PM +0200, Jakub Hrozek wrote:
> Hi,
>
> the attached patches implement
> https://fedorahosted.org/sssd/ticket/1962. When a new option,
> ipa_server_mode is set to True, then subdomain/trusted users are not
> looked up using the extop plugin but AD ID context is initialized and
> the users are looked up directly with AD code. This is in support of
> legacy clients looking up trusted AD users and groups.
I forgot to add that until FreeIPA gains the ability to attach PAC to
the TGT you obtain you need to use a keytab from AD to auth with AD.
Attached is a simple patch (just for demo purposes) that I used during
my testing.
-------------- next part --------------
>From 59d64e2d817cc27b52454818085e501bf136a9ed Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Wed, 19 Jun 2013 10:58:27 +0200
Subject: [PATCH] NOPUSH: Hardcode the AD keytab and host name for testing
---
src/providers/ad/ad_common.c | 7 +++++++
src/providers/ipa/ipa_subdomains.c | 2 ++
2 files changed, 9 insertions(+)
diff --git a/src/providers/ad/ad_common.c b/src/providers/ad/ad_common.c
index e457d5285dd71f6814a727a1fea7c468faa8fd3c..c2ace5c6672525c6ef5caae8e1f388b4e04f953f 100644
--- a/src/providers/ad/ad_common.c
+++ b/src/providers/ad/ad_common.c
@@ -147,6 +147,13 @@ ad_create_default_options(TALLOC_CTX *mem_ctx,
return NULL;
}
+ ret = dp_opt_set_string(ad_options->basic, AD_KEYTAB, "/root/tuser.keytab");
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE, ("Cannot set AD keytab\n"));
+ talloc_free(ad_options);
+ return NULL;
+ }
+
ret = ad_set_ad_id_options(ad_options, ad_options->id);
if (ret != EOK) {
talloc_free(ad_options);
diff --git a/src/providers/ipa/ipa_subdomains.c b/src/providers/ipa/ipa_subdomains.c
index 788346aa22fd0b59a4e1bd69990f8aa10a5e11d2..66bbca29e4563ab22139127ef616936e17346dff 100644
--- a/src/providers/ipa/ipa_subdomains.c
+++ b/src/providers/ipa/ipa_subdomains.c
@@ -1248,12 +1248,14 @@ int ipa_ad_subdom_init(struct be_ctx *be_ctx,
DEBUG(SSSDBG_CRIT_FAILURE, ("No Kerberos realm for IPA?\n"));
return EINVAL;
}
+ realm = "AD.EXAMPLE.COM";
hostname = dp_opt_get_string(id_ctx->ipa_options->basic, IPA_HOSTNAME);
if (hostname == NULL) {
DEBUG(SSSDBG_CRIT_FAILURE, ("No host name for IPA?\n"));
return EINVAL;
}
+ hostname = "tuser at AD.EXAMPLE.COM";
id_ctx->server_mode = talloc(id_ctx, struct ipa_server_mode_ctx);
if (id_ctx->server_mode == NULL) {
--
1.8.3.1
More information about the sssd-devel
mailing list