[SSSD-users] New AD provider howto

Marko Myllynen myllynen at redhat.com
Wed May 21 05:35:33 UTC 2014


Hi,

this went unanswered so ...

On 2014-04-17 14:16, Marko Myllynen wrote:
> On 2014-04-17 13:18, Jakub Hrozek wrote:
>> On Thu, Apr 17, 2014 at 09:05:42AM +0300, Marko Myllynen wrote:
>>
>>> - for completeness sake I'd add dns_lookup_kdc = true and master_kdc =
>>> server.ad.example.com to the krb5.conf example
>>
>> I've added dns_lookup_kdc, but I'm not sure about master_kdc, why do you
>> think it's needed? I normally prefer to stick to the defaults and let
>> the autodiscovery do its magic.
> 
> sorry, I meant adding master_kdc commented like kdc / admin_server
> already are. Under certain circumstances if you wanted to force using a
> certain KDC it was not enough to specify kdc / admin_server, you needed
> also master_kdc. In the past it was undocumented and when it was
> discovered it explained quite a few situations. Sumit or Alexander might
> remember the exact details, the bug report about it being undocumented
> doesn't go into details: https://bugzilla.redhat.com/show_bug.cgi?id=859961.

I added master_kdc to the example config based on the rationale above.

>> Right, after re-reading the section in man smb.conf, I agree password
>> server should not be used.
> 
> What do you think about adding create krb5 conf = no?

This seems unnecessary. So does actually currently listed client signing
= yes which is IMHO ambiguous, "yes" is not documented in the man page
and I don't know what would be the reason for changing this. But I
didn't remove that, perhaps someone had a reason to add it there.

Thanks,

-- 
Marko Myllynen


More information about the sssd-users mailing list