[SSSD] [PATCHES] Support one-way trusts with AD domains in IPA server mode

Jakub Hrozek jhrozek at redhat.com
Mon Jun 8 08:16:26 UTC 2015


On Thu, Jun 04, 2015 at 01:15:55PM +0200, Jakub Hrozek wrote:
> Hi,
> 
> the attached patches implement most of the one-way trust functionality.
> The trust directions, fetching keytabs and using different keytabs and
> different principals works well for me. I'm still working on changing
> the ldap_child to either use ccache collection or using the environment
> variables safer, also the failover changes are still missing. But the
> feature is testable in my opinion.
> 
> There are two NOSUBMIT patches that are useful only for testing until
> patches that allow the IPA server principal to read the direction are
> available. I hope exposing my super-secret DM password like that is OK,
> please change these patches in your testing..
> 
> Several patches are not strictly related to one-way trusts, but unify
> the info we store for subdomains in IPA and AD or info we store for
> subdomains that represent forest root versus member domains.
> 
> There are also patches that rename or refactor a bit functions in the
> ad_common.c module. I hope this is acceptable, because I had a hard time
> le-learning my way around the module. I still think we need to make the
> code that selects the appropriate principal from keytab readable better,
> currently the setting of "desired_primary" and "default_primary" is a
> total mess.
> 
> Most of the code is also unit-tested, so several patches just change
> tests.
> 
> Here are some points I'd like to get reviewed carefully as I'm not sure
> about them myself:
>     - do we need the SD_TRUST_DIRECTION_NOT_SET enum? I was going back
>       and forth between having it and just using either a NULL pointer
>       if the trust direction is uknown or a zero value.
>     - is the reading of the direction OK? Do we fall back the way we
>       should?
>     - are the additional data stored with (sub)domains like forest
>       stored for forest root subdomains and realm for master domains OK? In
>       my opinion they make processing of domains easier as there's fewer
>       special cases..
>     - should I add a full-blown getter for the forest_root member of
>       sss_domain_info a a first step towards making the structure
>       opaque?
> 
> Also feel free to propose more tests, either scenarios that I should
> test manually or something that should be unit tested.

Hi,

I fixed one casing issue that Sumit found and one similar issue that
Alexander found (and patched, thanks a lot!) and pushed new patches
here:
    https://fedorapeople.org/cgit/jhrozek/public_git/sssd.git/log/?h=oneway



More information about the sssd-devel mailing list