Re: [SSSD] [PATCH] Allow krb5_realm to override ipa_domain

[Sumit Bose]

On Mon, Feb 21, 2011 at 02:04:52PM -0500, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 02/21/2011 11:45 AM, Stephen Gallagher wrote:
> > On 02/21/2011 11:34 AM, Stephen Gallagher wrote:
> > > It is possible to set up FreeIPA servers where the Kerberos realm
> > > differs from the IPA domain name. We need to allow setting the
> > > krb5_realm explicitly to handle this.
> > > Fixes https://bugzilla.redhat.com/show_bug.cgi?id=679082
> >
> > Withdrawing this patch. I just realized it's incomplete.
>
> Un-withdrawing this patch (re-attaching for posterity).
>
> I thought we were not honoring krb5_realm elsewhere, because we were
> just doing dp_get_option(KRB5_REALM), but I discovered that
> ipa_get_id_options() and ipa_get_auth_options() forcibly sets these
> values to be correct.
>
> So the only piece that was incorrect was ipa_service_init() (which only
> uses the realm for writing the krb5info file.

ACK

bye,
Sumit
> Stephen Gallagher
> RHCE 804006346421761
>
> Delivering value year after year.
> Red Hat ranks #1 in value among software vendors.
> http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk1it1QACgkQeiVVYja6o6Nv3wCgks31OXyxAv/MrxtkOHN9r1aA
> X1MAoK1o9rzXKtRw3miVh1HGCdQwc9zp
> =Q3fi
> -----END PGP SIGNATURE-----