[SSSD] sssd and rpc

Alexander Bokovoy abokovoy at redhat.com
Wed Jan 22 08:08:43 UTC 2014


On Tue, 21 Jan 2014, Dmitri Pal wrote:
>On 01/21/2014 07:08 PM, Yassir Elley wrote:
>> It seems that the only network protocols used by SSSD are LDAP, KRB5, and DNS. On the other hand, Samba makes RPC calls all over the place (for authentication, etc).
>>
>> * Does sssd make any RPC calls (e.g. when interacting with a Domain Controller)?
>The global catalog part uses RPC for example.
It is a bit more convoluted. GC directly does not require RPC, it is
just LDAP on a separate port, but some operations do require consulting
MS-RPC and GC at the same time, by nature of Microsoft implementation
requiring to have shared state communication i.e. some calls are
assumed to have changes applied through MS-RPC to be visible over LDAP
and reflected on Kerberos policies levels in the next set of calls.

>
>> * Does Microsoft require clients to use RPC calls to access certain DC functionality?
>
>Yes.
>
>> * If not, why does Samba use RPC calls rather than LDAP/KRB5?
>AFAIK SSSD does use it, not to the same extent as winbind but it does.
>Some of the functionality like global catalog is available only via RPC.
SSSD does not implement domain controller or full Windows client
functionality, it does not operate like proper Windows client, does not
answer on MS-RPC calls related to remote registry, does not respond to
certain policy-related operations and so on. A samba domain member does
it, as well as samba domain controller, to a different degree. Winbindd
does a lot more than authentication/identity mapping as well.

Part of long term plans in Samba is to decouple auth/identity/domain
membership/trusts from Winbind so that there is clear separation between
domain controller and domain member functions. The latter also split
into several categories and basic ones are fairly easy could be covered
by SSSD (not all right now but Sumit is working on that). The former
will still require more than winbindd and will be something that Samba
is needed for.

-- 
/ Alexander Bokovoy



More information about the sssd-devel mailing list