[SSSD] [PATCH] BUILD: Enable the sssd krb5 localauth plugin by default

Sumit Bose sbose at redhat.com
Thu Nov 5 12:51:46 UTC 2015


On Thu, Nov 05, 2015 at 01:02:07PM +0100, Lukas Slebodnik wrote:
> On (05/11/15 12:42), Sumit Bose wrote:
> >On Thu, Nov 05, 2015 at 12:12:17PM +0100, Lukas Slebodnik wrote:
> >> ehlo,
> >> 
> >> attached simple patch is a result of "Fedora end of life"
> >> message for related Fedora ticket.
> >> 
> >> If you have an idea about better names I will be glad to change them.
> >> 
> >> BTW shoulw we also remove this part from function
> >> sss_write_krb5_conf_snippet
> >> 
> >> LS
> >
> >> From c4d56af303ba4385cf9ef1c9053545c243f07a44 Mon Sep 17 00:00:00 2001
> >> From: Lukas Slebodnik <lslebodn at redhat.com>
> >> Date: Thu, 5 Nov 2015 11:08:36 +0100
> >> Subject: [PATCH] BUILD: Enable the sssd krb5 localauth plugin by default
> >> 
> >> It will be installed to /etc/krb.conf.d/ only on these
> >> platforms which has krb5 with this directory
> >> 
> >> Resolves:
> >> https://fedorahosted.org/sssd/ticket/2449
> >
> >...
> >
> >
> >> new file mode 100644
> >> index 0000000000000000000000000000000000000000..950cab8200eb50d7fc878723d38c93d5b616e468
> >> --- /dev/null
> >> +++ b/src/examples/sssd_localauth.conf.in
> >> @@ -0,0 +1,5 @@
> >> +[plugins]
> >> + localauth = {
> >> +  module = sssd:@krb5localauth_plugindir@/sssd_krb5_localauth_plugin.so
> >> +  enable_only = sssd
> >> + }
> >
> >just a comment, I think enable_only should not be used here. I added it
> >originally becasue I thought no other modules would be needed anymore,
> >but I was wrong, see e.g. https://fedorahosted.org/sssd/ticket/2788 or
> >https://fedorahosted.org/sssd/ticket/2707. 
> >
> I inspired in /var/lib/sss/pubconf/krb5.include.d/localauth_plugin
> 
> I removed the option enable_only.
> Will it solve #2707 and #2788?
> or it is unrelated.

It depends. If e.g. the AD and IPA providers would not create
/var/lib/sss/pubconf/krb5.include.d/localauth_plugin anymore if
/etc/krb5.conf.d/sssd_localauth.conf exists I think #2788 is fixed
because we would fall back to the builtin k5login check if enable_only
is not set in /etc/krb5.conf.d/sssd_localauth.conf. If both files exists
and there is a 'includedir /var/lib/sss/pubconf/krb5.include.d/' in
/etc/krb5.conf it depends which file is processed first so I think we
should try to avoid it.

Btw, what about the domain_realm mapping files we create in
/var/lib/sss/pubconf/krb5.include.d/localauth_plugin ? Should they be
created in /etc/krb5.conf.d/ if the directory exists? (Must not be
solved in the context of this ticket).

If the file is labeled as '%config(noreplace)' in the spec
file we could say that the list is now configurable because changes stay
and close #2707 as well.

bye,
Sumit
> 
> LS


More information about the sssd-devel mailing list