[SSSD] New AD provider howto

Marko Myllynen myllynen at redhat.com
Thu Apr 17 11:16:59 UTC 2014


Hi,

On 2014-04-17 13:18, Jakub Hrozek wrote:
> On Thu, Apr 17, 2014 at 09:05:42AM +0300, Marko Myllynen wrote:
> 
>> - for completeness sake I'd add dns_lookup_kdc = true and master_kdc =
>> server.ad.example.com to the krb5.conf example
> 
> I've added dns_lookup_kdc, but I'm not sure about master_kdc, why do you
> think it's needed? I normally prefer to stick to the defaults and let
> the autodiscovery do its magic.

sorry, I meant adding master_kdc commented like kdc / admin_server
already are. Under certain circumstances if you wanted to force using a
certain KDC it was not enough to specify kdc / admin_server, you needed
also master_kdc. In the past it was undocumented and when it was
discovered it explained quite a few situations. Sumit or Alexander might
remember the exact details, the bug report about it being undocumented
doesn't go into details: https://bugzilla.redhat.com/show_bug.cgi?id=859961.

>> - I would at least comment out password server in smb.conf
> 
> Right, after re-reading the section in man smb.conf, I agree password
> server should not be used.

What do you think about adding create krb5 conf = no?

> I've changed the wiki page accordingly. Thanks a lot for the
> suggestions!

Glad to help!

Thanks,

-- 
Marko Myllynen



More information about the sssd-devel mailing list