[SSSD] [PATCH] MAN: Clarify the new krb5_use_fast IPA default

Jakub Hrozek jhrozek at redhat.com
Mon Feb 17 17:30:35 UTC 2014


On Mon, Feb 17, 2014 at 06:19:03PM +0100, Jakub Hrozek wrote:
> On Mon, Feb 17, 2014 at 11:59:29AM -0500, Simo Sorce wrote:
> > On Mon, 2014-02-17 at 17:35 +0100, Jakub Hrozek wrote:
> > > Hi,
> > > 
> > > while crafting the 1.11.4 release notes I realized that the new
> > > krb5_use_fast IPA default was not reflected in the man page. This patch
> > > fixes this omission.
> > 
> > Ack, to this patch.
> > 
> > Although maybe we should change in future and instead not the different
> > defaults in the respective sssd-ipa and sssd-ad mnapages ?
> 
> I actually think your suggestion is better as that's what we use with
> other options most of the time.

Attached is a patch that copies the option to the sssd-ipa man page
directly with the right defaults. I also removed the note that a keytab
is requires (since all IPA clients have keytabs) and fixed one minor
typo in the sssd-krb5 man page that I found by accident.

Thanks for the review.
-------------- next part --------------
>From 74544d3010a4062fe74df529cb4e00b87a66ea0c Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Mon, 17 Feb 2014 17:30:52 +0100
Subject: [PATCH] MAN: Clarify the new krb5_use_fast IPA default

---
 src/man/sssd-ipa.5.xml  | 34 ++++++++++++++++++++++++++++++++++
 src/man/sssd-krb5.5.xml |  2 +-
 2 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/src/man/sssd-ipa.5.xml b/src/man/sssd-ipa.5.xml
index bbee1f80a55d4c9743daca51efb47b4071e1ff7b..dfcc595deda736fd039cd60448f55256d765d39d 100644
--- a/src/man/sssd-ipa.5.xml
+++ b/src/man/sssd-ipa.5.xml
@@ -394,6 +394,40 @@
                 </varlistentry>
 
                 <varlistentry>
+                    <term>krb5_use_fast (string)</term>
+                    <listitem>
+                        <para>
+                            Enables flexible authentication secure tunneling
+                            (FAST) for Kerberos pre-authentication. The
+                            following options are supported:
+                        </para>
+                        <para>
+                            <emphasis>never</emphasis> use FAST.
+                        </para>
+                        <para>
+                            <emphasis>try</emphasis> to use FAST. If the server
+                            does not support FAST, continue the
+                            authentication without it. This is
+                            equivalent to not setting this option at all.
+                        </para>
+                        <para>
+                            <emphasis>demand</emphasis> to use FAST. The
+                            authentication fails if the server does not
+                            require fast.
+                        </para>
+                        <para>
+                            Default: try
+                        </para>
+                        <para>
+                            NOTE: SSSD supports FAST only with
+                            MIT Kerberos version 1.8 and later. If SSSD is used
+                            with an older version of MIT Kerberos, using this
+                            option is a configuration error.
+                        </para>
+                    </listitem>
+                </varlistentry>
+
+                <varlistentry>
                     <term>ipa_hbac_refresh (integer)</term>
                     <listitem>
                         <para>
diff --git a/src/man/sssd-krb5.5.xml b/src/man/sssd-krb5.5.xml
index 5619e9b7ecb77ca3727cdea96a281efba8750fc9..eda37eae5a40023d13763641ca6bf19bc10c142b 100644
--- a/src/man/sssd-krb5.5.xml
+++ b/src/man/sssd-krb5.5.xml
@@ -502,7 +502,7 @@
                         </para>
 
                         <para>
-                            Default: false (AD provide: true)
+                            Default: false (AD provider: true)
                         </para>
                     </listitem>
                 </varlistentry>
-- 
1.8.5.3



More information about the sssd-devel mailing list