[SSSD] [PATCH] IPA: Default to krb5_use_fast=try

Jakub Hrozek jhrozek at redhat.com
Thu Feb 13 18:41:12 UTC 2014


On Thu, Feb 13, 2014 at 12:20:48PM -0500, Nathaniel McCallum wrote:
> On Wed, 2014-02-12 at 14:08 +0100, Jakub Hrozek wrote:
> > On Wed, Feb 12, 2014 at 01:09:44PM +0100, Pavel Březina wrote:
> > > On 02/11/2014 05:32 PM, Jakub Hrozek wrote:
> > > >Hi,
> > > >
> > > >as agreed with Nathaniel, we should change the defaults of krb_use_fast
> > > >to "try" with the IPA backend and also change the default of
> > > >krb5_fast_principal to "host/$client_hostname".
> > > >
> > > >So far I've tested this patch on F-20 only with IPA server
> > > >3.3.90GIT0f82cbf. More testing is needed with older IPA servers as well,
> > > >but that shouldn't block the patch review.
> > > 
> > > Nack.
> > > 
> > > You set value variable to host/$client, but you also need to set the
> > > krb5_fast_principal option via dp_opt_set_string(). Or am I missing
> > > anything?
> > 
> > No, you're not missing anything, this just happens when half of the
> > patch is written on a local machine and the other on a VM..and then you
> > send the local version without syncing. Oh well, thanks for the catch.
> > 
> > New patch is attached.
> 
> It took me a couple days to get a test environment up, but I tested
> against RHEL 6.2 - 6.5. Nothing breaks in this case. I also tested
> against F20 w/ OTP patches, and everything works (including OTP auth).
> 
> ACK from me.
> 
> Nathaniel

Pushed to sssd-1-11



More information about the sssd-devel mailing list