[SSSD] Design discussion - Changes required to support one-way trusts
Alexander Bokovoy
abokovoy at redhat.com
Tue Apr 28 10:34:56 UTC 2015
On Tue, 28 Apr 2015, Jakub Hrozek wrote:
>On Mon, Apr 27, 2015 at 10:32:03AM +0200, Jakub Hrozek wrote:
>> Sure, I will add a more explicit note once we agree what the mechanism
>> would be.
>
>I modified the design page to agree with this discussion:
> https://fedorahosted.org/sssd/wiki/DesignDocs/OneWayTrusts?action=diff&version=10&old_version=9
>
>The changes include:
> - noted that we fetch all enctypes from IPA and that IPA is
> responsible for filtering/requesting the right keytabs
> - note we would prune and fetch the keytabs on restart. If we see
> during development that this is taking too much time, we can back
> off.
> - there is a note that inbound trusts are ignored
> - there is a note why we're calling ipa-getkeytab explicitly and why
> we might consider moving to calling the extop ourselves in the
> future
> - keytab comparison is spelled out more explicitly (keys are
> compared) and there is an explicit note that krb5 calls don't
> hurt because the keytab is owned by the sssd user already.
>
>I'll file the per-task tickets now.
ACK. Do you need FreeIPA tickets too? Just file them as well.
--
/ Alexander Bokovoy
More information about the sssd-devel
mailing list