[SSSD] [PATCH] MAN: Clarify the new krb5_use_fast IPA default
Jakub Hrozek
jhrozek at redhat.com
Mon Feb 17 17:30:35 UTC 2014
On Mon, Feb 17, 2014 at 06:19:03PM +0100, Jakub Hrozek wrote:
> On Mon, Feb 17, 2014 at 11:59:29AM -0500, Simo Sorce wrote:
> > On Mon, 2014-02-17 at 17:35 +0100, Jakub Hrozek wrote:
> > > Hi,
> > >
> > > while crafting the 1.11.4 release notes I realized that the new
> > > krb5_use_fast IPA default was not reflected in the man page. This patch
> > > fixes this omission.
> >
> > Ack, to this patch.
> >
> > Although maybe we should change in future and instead not the different
> > defaults in the respective sssd-ipa and sssd-ad mnapages ?
>
> I actually think your suggestion is better as that's what we use with
> other options most of the time.
Attached is a patch that copies the option to the sssd-ipa man page
directly with the right defaults. I also removed the note that a keytab
is requires (since all IPA clients have keytabs) and fixed one minor
typo in the sssd-krb5 man page that I found by accident.
Thanks for the review.
-------------- next part --------------
>From 74544d3010a4062fe74df529cb4e00b87a66ea0c Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Mon, 17 Feb 2014 17:30:52 +0100
Subject: [PATCH] MAN: Clarify the new krb5_use_fast IPA default
---
src/man/sssd-ipa.5.xml | 34 ++++++++++++++++++++++++++++++++++
src/man/sssd-krb5.5.xml | 2 +-
2 files changed, 35 insertions(+), 1 deletion(-)
diff --git a/src/man/sssd-ipa.5.xml b/src/man/sssd-ipa.5.xml
index bbee1f80a55d4c9743daca51efb47b4071e1ff7b..dfcc595deda736fd039cd60448f55256d765d39d 100644
--- a/src/man/sssd-ipa.5.xml
+++ b/src/man/sssd-ipa.5.xml
@@ -394,6 +394,40 @@
</varlistentry>
<varlistentry>
+ <term>krb5_use_fast (string)</term>
+ <listitem>
+ <para>
+ Enables flexible authentication secure tunneling
+ (FAST) for Kerberos pre-authentication. The
+ following options are supported:
+ </para>
+ <para>
+ <emphasis>never</emphasis> use FAST.
+ </para>
+ <para>
+ <emphasis>try</emphasis> to use FAST. If the server
+ does not support FAST, continue the
+ authentication without it. This is
+ equivalent to not setting this option at all.
+ </para>
+ <para>
+ <emphasis>demand</emphasis> to use FAST. The
+ authentication fails if the server does not
+ require fast.
+ </para>
+ <para>
+ Default: try
+ </para>
+ <para>
+ NOTE: SSSD supports FAST only with
+ MIT Kerberos version 1.8 and later. If SSSD is used
+ with an older version of MIT Kerberos, using this
+ option is a configuration error.
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
<term>ipa_hbac_refresh (integer)</term>
<listitem>
<para>
diff --git a/src/man/sssd-krb5.5.xml b/src/man/sssd-krb5.5.xml
index 5619e9b7ecb77ca3727cdea96a281efba8750fc9..eda37eae5a40023d13763641ca6bf19bc10c142b 100644
--- a/src/man/sssd-krb5.5.xml
+++ b/src/man/sssd-krb5.5.xml
@@ -502,7 +502,7 @@
</para>
<para>
- Default: false (AD provide: true)
+ Default: false (AD provider: true)
</para>
</listitem>
</varlistentry>
--
1.8.5.3
More information about the sssd-devel
mailing list