[SSSD] [PATCH] Only check UPN if enterprise principals are not used

Jakub Hrozek jhrozek at redhat.com
Fri May 3 19:03:08 UTC 2013


On Fri, May 03, 2013 at 08:59:26PM +0200, Jakub Hrozek wrote:
> On Fri, May 03, 2013 at 08:47:06PM +0200, Sumit Bose wrote:
> > On Fri, May 03, 2013 at 07:56:48PM +0200, Jakub Hrozek wrote:
> > > Currently when enterprise principals are enabled in the AD provider, we
> > > check if the UPN is the same as we'd expect. But when enterprise
> > > principals are enabled (which is by default in AD provider), then the
> > > principal krb5_child returns is different from what SSSD expects.
> > > 
> > > Sumit, you wrote the enterprise principal support, do you know if there
> > > is a better way than disabling the check altogether? Can we expect the
> > > principal in the form krb5_child sends it? This is how the principal
> > > looked on my setup for user "testlogin:
> > > 
> > > $ klist 
> > > Ticket cache: DIR::/run/user/947005183/krb5cc/tktDSjgIe
> > > Default principal: testlogin\@SSSD-AD.TEST at SSSD-AD.TEST
> > > 
> > > Valid starting     Expires            Service principal
> > > 05/03/13 17:52:32  05/04/13 03:52:32  krbtgt/SSSD-AD.TEST at SSSD-AD.TEST
> > >     renew until 05/10/13 17:52:32
> > 
> > Makes sense. ACK
> > 
> > bye,
> > Sumit
> 
> Thank you for the review, I opened
> https://fedorahosted.org/sssd/ticket/1906 to investigate the check
> deeper post-beta.

Pushed to master.



More information about the sssd-devel mailing list