[SSSD] [PATCHES] KDC proxy related fixes

Christian Heimes cheimes at redhat.com
Mon Aug 3 09:56:05 UTC 2015


On 2015-07-31 18:19, Sumit Bose wrote:
> On Fri, Jul 31, 2015 at 11:34:23AM +0200, Sumit Bose wrote:
>> Hi,
>>
>> it turned out that some of the current SSSD behaviour does not fit well
>> if a KDC proxy is configured, see
>> https://fedorahosted.org/sssd/ticket/2652 and
>> https://fedorahosted.org/sssd/ticket/2700 for details.
>>
>> The first patch in this series introduces a new call which checks if a
>> KDC proxy is configured as suggested in the tickets. The other two
>> patches aim to fix the respective ticket.
>>
>> bye,
>> Sumit
> 
> Please find attached a new version of the patches. They fix a memory
> leak found by Christian in the first patch and contain a different
> version of the third patch because the original version didn't fix the
> issue Alexander was seeing. There is only a minor change compared to the
> version Alexander tested, krb5.conf is not checked unconditionally but
> only if the state is offline.
> 
> There was another comment by Christian on irc. Currently the patches
> only check the kdc config entry. In theory if would be possible that for
> the kdc a direct connection is used while the admin_server is configured
> via a proxy. Since this is expected to be an un-common configuration I
> hope it can be added later. To solve this I think
> sss_krb5_realm_has_proxy() should get a second option indication if kdc
> or admin_server should be checked. Depending on the type of request,
> (pre-)auth or change password, or info file, kdcinfo or kpasswdinfo,
> sss_krb5_realm_has_proxy() should be called with the matching option.

sss_krb5_realm_has_proxy() looks good to me. IMHO it's fine to just
check kdc for https for now.

Christian


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 455 bytes
Desc: OpenPGP digital signature
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20150803/8034d69d/attachment.sig>


More information about the sssd-devel mailing list