[SSSD] [PATCHES] Heimdal Support

Simo Sorce simo at redhat.com
Thu Oct 17 18:59:58 UTC 2013


On Thu, 2013-10-17 at 07:49 -0400, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 10/17/2013 07:35 AM, Benjamin Franzke wrote:
> > Hi list,
> > 
> > I've tried to use sssd with heimdal, there were some fixes to be
> > done. Are you intrested in reviewing and integrating them?
> > 
> > They are available at: https://git.bnfr.net/sssd/log/?h=heimdal-1 
> > Note: They are on top of other build fixes i've send to the list
> > (but thats visible in the log).
> > 
> > This compiles without warnings and passes all make tests. Actually
> > i've added alternatives for deprecated (in terms of heimdal) 
> > kerberos functions to avoid warnings there.
> > 
> > I've tested this in a samba 4 environment (with the sssd-ad
> > module).
> > 
> 
> Just for the record, Heimdal support has come up before. Historically,
> our answer has been this: "SSSD upstream does not officially support
> using SSSD with Heimdal. This is because the SSSD upstream works
> closely with the MIT Kerberos upstream to have features that we need
> incorporated there."
> 
> In the past, we've allowed the community to contribute patches to work
> with Heimdal because there are some platforms out there that seem to
> prefer it, but the people who have contributed this have a habit of
> disappearing. We've always held to the idea that it's not the
> responsibility of the core upstream to maintain the Heimdal patches.
> 
> As move further along and the IPA and AD providers rely on
> ever-increasing MIT-specific features, I think the value of supporting
> Heimdal at all upstream continues to decrease.
> 
> I'd honestly prefer to propose that SSSD drops its Heimdal support
> entirely and stop giving the impression that it might work. If we
> don't do this, a secondary option would be to add a new configure flag
> for Heimdal usage that makes it clear that Heimdal support is largely
> incomplete.
> 
> 
> I'd honestly be more interested in taking a samba-like approach here
> and making it possible to statically build-in a copy of MIT Kerberos
> for those platforms that only have Heimdal (such as the BSDs), since
> this would allow those platforms to enjoy all of the advance
> functionality that SSSD-with-MIT can offer (such as FreeIPA
> cross-realm trusts).
> 
> 
> Benjamin: Please do not take this as an attack on you. This is a
> long-standing issue upstream and one that just keeps coming up.

I honestly see no problem maintaining experimental Heimdal support as
long as it is clearly documented that it is experimental.

Of course it must not break the primary library code, but beyond that I
see no damage in attempting to be friendly to distributions that choose
a different implementartion.

I am completely against the idea of embedding the Kerberos distribution
into SSSD, it was a very bad idea for Samba and would be for SSSD too.
A system can't really successfully use multiple implementations at the
same time except for specific carefully controlled cases, the "advanced
functionality" that SSSD-with-MIT would provide would probably amount to
just broken applications when credential caches formats do not match.
So, no thank you.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list