[PATCH] Allow krb5_realm to override ipa_domain

[Stephen Gallagher]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

It is possible to set up FreeIPA servers where the Kerberos realm
differs from the IPA domain name. We need to allow setting the
krb5_realm explicitly to handle this.

Fixes https://bugzilla.redhat.com/show_bug.cgi?id=679082

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk1ilBIACgkQeiVVYja6o6O4agCgkkuXLhmETabRb+hwWv0Rs0GX
> p70An2y4hEYUgMjpB9x4btKOa0IX9viC
> =u/46
> -----END PGP SIGNATURE-----

[Stephen Gallagher]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 02/21/2011 11:34 AM, Stephen Gallagher wrote:
>  It is possible to set up FreeIPA servers where the Kerberos realm
>  differs from the IPA domain name. We need to allow setting the
>  krb5_realm explicitly to handle this.
>  
>  Fixes https://bugzilla.redhat.com/show_bug.cgi?id=679082
>   

Withdrawing this patch. I just realized it's incomplete.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk1ilrgACgkQeiVVYja6o6PtQwCffkrcHnxgaT92FrsU/m9vG2MT
> HPUAn2VylaulY2DWGdNzbGqpY1+cczfm
> =hGeK
> -----END PGP SIGNATURE-----

[Stephen Gallagher]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 02/21/2011 11:45 AM, Stephen Gallagher wrote:
>  On 02/21/2011 11:34 AM, Stephen Gallagher wrote:
> > It is possible to set up FreeIPA servers where the Kerberos realm
> > differs from the IPA domain name. We need to allow setting the
> > krb5_realm explicitly to handle this.
>  
> > Fixes https://bugzilla.redhat.com/show_bug.cgi?id=679082
>  
>  
>  
>  Withdrawing this patch. I just realized it's incomplete.
>   
Un-withdrawing this patch (re-attaching for posterity).

I thought we were not honoring krb5_realm elsewhere, because we were
just doing dp_get_option(KRB5_REALM), but I discovered that
ipa_get_id_options() and ipa_get_auth_options() forcibly sets these
values to be correct.

So the only piece that was incorrect was ipa_service_init() (which only
uses the realm for writing the krb5info file.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk1it1QACgkQeiVVYja6o6Nv3wCgks31OXyxAv/MrxtkOHN9r1aA
> X1MAoK1o9rzXKtRw3miVh1HGCdQwc9zp
> =Q3fi
> -----END PGP SIGNATURE-----

[Sumit Bose]

On Mon, Feb 21, 2011 at 02:04:52PM -0500, Stephen Gallagher wrote:
>  -----BEGIN PGP SIGNED MESSAGE-----
>  Hash: SHA1
>  
>  On 02/21/2011 11:45 AM, Stephen Gallagher wrote:
>  > On 02/21/2011 11:34 AM, Stephen Gallagher wrote:
>  >> It is possible to set up FreeIPA servers where the Kerberos realm
>  >> differs from the IPA domain name. We need to allow setting the
>  >> krb5_realm explicitly to handle this.
>  > 
>  >> Fixes https://bugzilla.redhat.com/show_bug.cgi?id=679082
>  > 
>  > 
>  > 
>  > Withdrawing this patch. I just realized it's incomplete.
>  > 
>  
>  Un-withdrawing this patch (re-attaching for posterity).
>  
>  I thought we were not honoring krb5_realm elsewhere, because we were
>  just doing dp_get_option(KRB5_REALM), but I discovered that
>  ipa_get_id_options() and ipa_get_auth_options() forcibly sets these
>  values to be correct.
>  
>  So the only piece that was incorrect was ipa_service_init() (which only
>  uses the realm for writing the krb5info file.
>   
ACK

bye,
Sumit

>  - -- 
>  Stephen Gallagher
>  RHCE 804006346421761
>  
>  Delivering value year after year.
>  Red Hat ranks #1 in value among software vendors.
>  http://www.redhat.com/promo/vendor/
>  -----BEGIN PGP SIGNATURE-----
>  Version: GnuPG v1.4.11 (GNU/Linux)
>  Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>  
>  iEYEARECAAYFAk1it1QACgkQeiVVYja6o6Nv3wCgks31OXyxAv/MrxtkOHN9r1aA
>  X1MAoK1o9rzXKtRw3miVh1HGCdQwc9zp
>  =Q3fi
>  -----END PGP SIGNATURE-----

[Stephen Gallagher]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 02/22/2011 06:13 AM, Sumit Bose wrote:
>  On Mon, Feb 21, 2011 at 02:04:52PM -0500, Stephen Gallagher wrote:
>  Un-withdrawing this patch (re-attaching for posterity).
>  
>  I thought we were not honoring krb5_realm elsewhere, because we were
>  just doing dp_get_option(KRB5_REALM), but I discovered that
>  ipa_get_id_options() and ipa_get_auth_options() forcibly sets these
>  values to be correct.
>  
>  So the only piece that was incorrect was ipa_service_init() (which only
>  uses the realm for writing the krb5info file.
>  
>  
> > ACK 
Pushed to master and sssd-1-5.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk1jtAAACgkQeiVVYja6o6NcJgCfZWWgaMlwRh2InpxWSJS0ivfj
> OOQAnAqj2Llswe7ZlCYlAbF3E6ppcHAE
> =Wdh5
> -----END PGP SIGNATURE-----

[Sumit Bose]

On Tue, Feb 22, 2011 at 08:02:56AM -0500, Stephen Gallagher wrote:
>  -----BEGIN PGP SIGNED MESSAGE-----
>  Hash: SHA1
>  
>  On 02/22/2011 06:13 AM, Sumit Bose wrote:
>  > On Mon, Feb 21, 2011 at 02:04:52PM -0500, Stephen Gallagher wrote:
>  > Un-withdrawing this patch (re-attaching for posterity).
>  > 
>  > I thought we were not honoring krb5_realm elsewhere, because we were
>  > just doing dp_get_option(KRB5_REALM), but I discovered that
>  > ipa_get_id_options() and ipa_get_auth_options() forcibly sets these
>  > values to be correct.
>  > 
>  > So the only piece that was incorrect was ipa_service_init() (which only
>  > uses the realm for writing the krb5info file.
>  > 
>  > 
>  >> ACK
>  
>  Pushed to master and sssd-1-5. 
Sorry, I just realized that my testing was flawed. You access
options->id->basic in ipa_service_init() before it is initialized by
ipa_get_id_options().

bye,
Sumit

>  
>  - -- 
>  Stephen Gallagher
>  RHCE 804006346421761
>  
>  Delivering value year after year.
>  Red Hat ranks #1 in value among software vendors.
>  http://www.redhat.com/promo/vendor/
> >  -----BEGIN PGP SIGNATURE-----
> >  Version: GnuPG v1.4.11 (GNU/Linux)
> >  Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
> >  
> >  iEYEARECAAYFAk1jtAAACgkQeiVVYja6o6NcJgCfZWWgaMlwRh2InpxWSJS0ivfj
> >  OOQAnAqj2Llswe7ZlCYlAbF3E6ppcHAE
> >  =Wdh5
> >  -----END PGP SIGNATURE----- 
>  _______________________________________________
>  sssd-devel mailing list
>  sssd-devel(a)lists.fedorahosted.org
>  https://fedorahosted.org/mailman/listinfo/sssd-devel

[Stephen Gallagher]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 02/22/2011 12:10 PM, Sumit Bose wrote:
> > Sorry, I just realized that my testing was flawed. You access
> > options->id->basic in ipa_service_init() before it is initialized by
> > ipa_get_id_options(). 
Add krb5_realm to the basic IPA options

Previously, this was only handled by the internal LDAP and Kerberos
providers, but this wasn't available early enough to properly
handle setting up the krb5_service for failover and creating the
krb5info files.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk1j9hUACgkQeiVVYja6o6N2YACfW1TQKx3nOUU6C8UT5KbWNXEi
> MZ0An1W8nHKxqTqo+w2mEuI46wPLVXmY
> =9Yio
> -----END PGP SIGNATURE-----

[Sumit Bose]

On Tue, Feb 22, 2011 at 12:44:53PM -0500, Stephen Gallagher wrote:
>  -----BEGIN PGP SIGNED MESSAGE-----
>  Hash: SHA1
>  
>  On 02/22/2011 12:10 PM, Sumit Bose wrote:
>  >> Sorry, I just realized that my testing was flawed. You access
>  >> options->id->basic in ipa_service_init() before it is initialized by
>  >> ipa_get_id_options().
>  
>  Add krb5_realm to the basic IPA options
>  
>  Previously, this was only handled by the internal LDAP and Kerberos
>  providers, but this wasn't available early enough to properly
>  handle setting up the krb5_service for failover and creating the
>  krb5info files. 
ACK

bye,
Sumit

>  
>  - -- 
>  Stephen Gallagher
>  RHCE 804006346421761
>  
>  Delivering value year after year.
>  Red Hat ranks #1 in value among software vendors.
>  http://www.redhat.com/promo/vendor/
>  -----BEGIN PGP SIGNATURE-----
>  Version: GnuPG v1.4.11 (GNU/Linux)
>  Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>  
>  iEYEARECAAYFAk1j9hUACgkQeiVVYja6o6N2YACfW1TQKx3nOUU6C8UT5KbWNXEi
>  MZ0An1W8nHKxqTqo+w2mEuI46wPLVXmY
>  =9Yio
>  -----END PGP SIGNATURE-----

[Stephen Gallagher]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 02/22/2011 03:17 PM, Sumit Bose wrote:
>  On Tue, Feb 22, 2011 at 12:44:53PM -0500, Stephen Gallagher wrote:
>  On 02/22/2011 12:10 PM, Sumit Bose wrote:
> >>>> Sorry, I just realized that my testing was flawed. You access
> >>>> options->id->basic in ipa_service_init() before it is initialized
> by
> >>>> ipa_get_id_options().
>  
>  Add krb5_realm to the basic IPA options
>  
>  Previously, this was only handled by the internal LDAP and Kerberos
>  providers, but this wasn't available early enough to properly
>  handle setting up the krb5_service for failover and creating the
>  krb5info files.
>  
> > ACK
>   
Pushed to master and sssd-1-5


- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk1kGwYACgkQeiVVYja6o6OJ1ACglaAxcS5162WksLeHzXu6mgFS
> RMYAninH1UXoSHu+HPafkqgveps1HeXo
> =lgeo
> -----END PGP SIGNATURE-----