[SSSD] [PATCH] IPA: Default to krb5_use_fast=try

Alexander Bokovoy abokovoy at redhat.com
Thu Feb 13 13:05:04 UTC 2014


On Wed, 12 Feb 2014, Jakub Hrozek wrote:
>On Wed, Feb 12, 2014 at 01:09:44PM +0100, Pavel Březina wrote:
>> On 02/11/2014 05:32 PM, Jakub Hrozek wrote:
>> >Hi,
>> >
>> >as agreed with Nathaniel, we should change the defaults of krb_use_fast
>> >to "try" with the IPA backend and also change the default of
>> >krb5_fast_principal to "host/$client_hostname".
>> >
>> >So far I've tested this patch on F-20 only with IPA server
>> >3.3.90GIT0f82cbf. More testing is needed with older IPA servers as well,
>> >but that shouldn't block the patch review.
>>
>> Nack.
>>
>> You set value variable to host/$client, but you also need to set the
>> krb5_fast_principal option via dp_opt_set_string(). Or am I missing
>> anything?
>
>No, you're not missing anything, this just happens when half of the
>patch is written on a local machine and the other on a VM..and then you
>send the local version without syncing. Oh well, thanks for the catch.
>
>New patch is attached.
ACK. Works fine for me. I've built a repo to test all of the two-factor
feature:
http://copr.fedoraproject.org/coprs/abbra/freeipa-otp-unstable/

-- 
/ Alexander Bokovoy



More information about the sssd-devel mailing list