[SSSD] [PATCHES] Support one-way trusts with AD domains in IPA server mode
Jakub Hrozek
jhrozek at redhat.com
Mon Jun 8 08:16:26 UTC 2015
On Thu, Jun 04, 2015 at 01:15:55PM +0200, Jakub Hrozek wrote:
> Hi,
>
> the attached patches implement most of the one-way trust functionality.
> The trust directions, fetching keytabs and using different keytabs and
> different principals works well for me. I'm still working on changing
> the ldap_child to either use ccache collection or using the environment
> variables safer, also the failover changes are still missing. But the
> feature is testable in my opinion.
>
> There are two NOSUBMIT patches that are useful only for testing until
> patches that allow the IPA server principal to read the direction are
> available. I hope exposing my super-secret DM password like that is OK,
> please change these patches in your testing..
>
> Several patches are not strictly related to one-way trusts, but unify
> the info we store for subdomains in IPA and AD or info we store for
> subdomains that represent forest root versus member domains.
>
> There are also patches that rename or refactor a bit functions in the
> ad_common.c module. I hope this is acceptable, because I had a hard time
> le-learning my way around the module. I still think we need to make the
> code that selects the appropriate principal from keytab readable better,
> currently the setting of "desired_primary" and "default_primary" is a
> total mess.
>
> Most of the code is also unit-tested, so several patches just change
> tests.
>
> Here are some points I'd like to get reviewed carefully as I'm not sure
> about them myself:
> - do we need the SD_TRUST_DIRECTION_NOT_SET enum? I was going back
> and forth between having it and just using either a NULL pointer
> if the trust direction is uknown or a zero value.
> - is the reading of the direction OK? Do we fall back the way we
> should?
> - are the additional data stored with (sub)domains like forest
> stored for forest root subdomains and realm for master domains OK? In
> my opinion they make processing of domains easier as there's fewer
> special cases..
> - should I add a full-blown getter for the forest_root member of
> sss_domain_info a a first step towards making the structure
> opaque?
>
> Also feel free to propose more tests, either scenarios that I should
> test manually or something that should be unit tested.
Hi,
I fixed one casing issue that Sumit found and one similar issue that
Alexander found (and patched, thanks a lot!) and pushed new patches
here:
https://fedorapeople.org/cgit/jhrozek/public_git/sssd.git/log/?h=oneway
More information about the sssd-devel
mailing list