[SSSD] [PATCH] IPA: Default to krb5_use_fast=try

Jakub Hrozek jhrozek at redhat.com
Thu Feb 13 18:06:59 UTC 2014


On Wed, Feb 12, 2014 at 02:08:46PM +0100, Jakub Hrozek wrote:
> On Wed, Feb 12, 2014 at 01:09:44PM +0100, Pavel Březina wrote:
> > On 02/11/2014 05:32 PM, Jakub Hrozek wrote:
> > >Hi,
> > >
> > >as agreed with Nathaniel, we should change the defaults of krb_use_fast
> > >to "try" with the IPA backend and also change the default of
> > >krb5_fast_principal to "host/$client_hostname".
> > >
> > >So far I've tested this patch on F-20 only with IPA server
> > >3.3.90GIT0f82cbf. More testing is needed with older IPA servers as well,
> > >but that shouldn't block the patch review.
> > 
> > Nack.
> > 
> > You set value variable to host/$client, but you also need to set the
> > krb5_fast_principal option via dp_opt_set_string(). Or am I missing
> > anything?
> 
> No, you're not missing anything, this just happens when half of the
> patch is written on a local machine and the other on a VM..and then you
> send the local version without syncing. Oh well, thanks for the catch.
> 
> New patch is attached.

The patch that Pavel, Alexander and Nathaniel acked is still valid for
sssd-1-11, however, master already uses different DEBUG macros. Attached
is a patch for master only which differs only in DEBUG macro invocation.
-------------- next part --------------
>From cce8f8256cfffa03eb887643719d08dd8e0bf0f1 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Tue, 11 Feb 2014 15:36:04 +0100
Subject: [PATCH] IPA: Default to krb5_use_fast=try

---
 src/providers/ipa/ipa_common.c | 27 +++++++++++++++++++++++++++
 src/providers/ipa/ipa_opts.h   |  2 +-
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c
index 4db7c589bc40c898d1256351a0aeddd17d0ebf12..c0b6ee2ea9841c549f561195cab3ed38ecc626b3 100644
--- a/src/providers/ipa/ipa_common.c
+++ b/src/providers/ipa/ipa_common.c
@@ -665,6 +665,33 @@ int ipa_get_auth_options(struct ipa_options *ipa_opts,
                   dp_opt_get_string(ipa_opts->auth, KRB5_REALM));
     }
 
+    /* If krb5_fast_principal was not set explicitly, default to
+     * host/$client_hostname
+     */
+    value = dp_opt_get_string(ipa_opts->auth, KRB5_FAST_PRINCIPAL);
+    if (value == NULL) {
+        value = talloc_asprintf(ipa_opts->auth, "host/%s",
+                                    dp_opt_get_string(ipa_opts->basic,
+                                                      IPA_HOSTNAME));
+        if (value == NULL) {
+            DEBUG(SSSDBG_CRIT_FAILURE, "Cannot set %s!\n",
+                     ipa_opts->auth[KRB5_FAST_PRINCIPAL].opt_name);
+            ret = ENOMEM;
+            goto done;
+        }
+
+        ret = dp_opt_set_string(ipa_opts->auth, KRB5_FAST_PRINCIPAL,
+                                value);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_CRIT_FAILURE, "Cannot set %s!\n",
+                     ipa_opts->auth[KRB5_FAST_PRINCIPAL].opt_name);
+            goto done;
+        }
+
+        DEBUG(SSSDBG_CONF_SETTINGS, "Option %s set to %s\n",
+              ipa_opts->auth[KRB5_FAST_PRINCIPAL].opt_name, value);
+    }
+
     /* Set flag that controls whether we want to write the
      * kdcinfo files at all
      */
diff --git a/src/providers/ipa/ipa_opts.h b/src/providers/ipa/ipa_opts.h
index bf9f3bc4288af0f7eba715e4c768cc3043472e95..909c431eefa778f97767af241829ac81256fc464 100644
--- a/src/providers/ipa/ipa_opts.h
+++ b/src/providers/ipa/ipa_opts.h
@@ -275,7 +275,7 @@ struct dp_option ipa_def_krb5_opts[] = {
     { "krb5_renewable_lifetime", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "krb5_lifetime", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "krb5_renew_interval", DP_OPT_STRING, NULL_STRING, NULL_STRING },
-    { "krb5_use_fast", DP_OPT_STRING, NULL_STRING, NULL_STRING },
+    { "krb5_use_fast", DP_OPT_STRING, { "try" }, NULL_STRING },
     { "krb5_fast_principal", DP_OPT_STRING, NULL_STRING, NULL_STRING },
     { "krb5_canonicalize", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
     { "krb5_use_enterprise_principal", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
-- 
1.8.5.3



More information about the sssd-devel mailing list