-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
It is possible to set up FreeIPA servers where the Kerberos realm differs from the IPA domain name. We need to allow setting the krb5_realm explicitly to handle this.
Fixes https://bugzilla.redhat.com/show_bug.cgi?id=679082
- -- Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 02/21/2011 11:34 AM, Stephen Gallagher wrote:
It is possible to set up FreeIPA servers where the Kerberos realm differs from the IPA domain name. We need to allow setting the krb5_realm explicitly to handle this.
Withdrawing this patch. I just realized it's incomplete.
- -- Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 02/21/2011 11:45 AM, Stephen Gallagher wrote:
On 02/21/2011 11:34 AM, Stephen Gallagher wrote:
It is possible to set up FreeIPA servers where the Kerberos realm differs from the IPA domain name. We need to allow setting the krb5_realm explicitly to handle this.
Withdrawing this patch. I just realized it's incomplete.
Un-withdrawing this patch (re-attaching for posterity).
I thought we were not honoring krb5_realm elsewhere, because we were just doing dp_get_option(KRB5_REALM), but I discovered that ipa_get_id_options() and ipa_get_auth_options() forcibly sets these values to be correct.
So the only piece that was incorrect was ipa_service_init() (which only uses the realm for writing the krb5info file.
- -- Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/
On Mon, Feb 21, 2011 at 02:04:52PM -0500, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 02/21/2011 11:45 AM, Stephen Gallagher wrote:
On 02/21/2011 11:34 AM, Stephen Gallagher wrote:
It is possible to set up FreeIPA servers where the Kerberos realm differs from the IPA domain name. We need to allow setting the krb5_realm explicitly to handle this.
Withdrawing this patch. I just realized it's incomplete.
Un-withdrawing this patch (re-attaching for posterity).
I thought we were not honoring krb5_realm elsewhere, because we were just doing dp_get_option(KRB5_REALM), but I discovered that ipa_get_id_options() and ipa_get_auth_options() forcibly sets these values to be correct.
So the only piece that was incorrect was ipa_service_init() (which only uses the realm for writing the krb5info file.
ACK
bye, Sumit
Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk1it1QACgkQeiVVYja6o6Nv3wCgks31OXyxAv/MrxtkOHN9r1aA X1MAoK1o9rzXKtRw3miVh1HGCdQwc9zp =Q3fi -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 02/22/2011 06:13 AM, Sumit Bose wrote:
On Mon, Feb 21, 2011 at 02:04:52PM -0500, Stephen Gallagher wrote: Un-withdrawing this patch (re-attaching for posterity).
I thought we were not honoring krb5_realm elsewhere, because we were just doing dp_get_option(KRB5_REALM), but I discovered that ipa_get_id_options() and ipa_get_auth_options() forcibly sets these values to be correct.
So the only piece that was incorrect was ipa_service_init() (which only uses the realm for writing the krb5info file.
ACK
Pushed to master and sssd-1-5.
- -- Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/
On Tue, Feb 22, 2011 at 08:02:56AM -0500, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 02/22/2011 06:13 AM, Sumit Bose wrote:
On Mon, Feb 21, 2011 at 02:04:52PM -0500, Stephen Gallagher wrote: Un-withdrawing this patch (re-attaching for posterity).
I thought we were not honoring krb5_realm elsewhere, because we were just doing dp_get_option(KRB5_REALM), but I discovered that ipa_get_id_options() and ipa_get_auth_options() forcibly sets these values to be correct.
So the only piece that was incorrect was ipa_service_init() (which only uses the realm for writing the krb5info file.
ACK
Pushed to master and sssd-1-5.
Sorry, I just realized that my testing was flawed. You access options->id->basic in ipa_service_init() before it is initialized by ipa_get_id_options().
bye, Sumit
Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk1jtAAACgkQeiVVYja6o6NcJgCfZWWgaMlwRh2InpxWSJS0ivfj OOQAnAqj2Llswe7ZlCYlAbF3E6ppcHAE =Wdh5 -----END PGP SIGNATURE----- _______________________________________________ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 02/22/2011 12:10 PM, Sumit Bose wrote:
Sorry, I just realized that my testing was flawed. You access options->id->basic in ipa_service_init() before it is initialized by ipa_get_id_options().
Add krb5_realm to the basic IPA options
Previously, this was only handled by the internal LDAP and Kerberos providers, but this wasn't available early enough to properly handle setting up the krb5_service for failover and creating the krb5info files.
- -- Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/
On Tue, Feb 22, 2011 at 12:44:53PM -0500, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 02/22/2011 12:10 PM, Sumit Bose wrote:
Sorry, I just realized that my testing was flawed. You access options->id->basic in ipa_service_init() before it is initialized by ipa_get_id_options().
Add krb5_realm to the basic IPA options
Previously, this was only handled by the internal LDAP and Kerberos providers, but this wasn't available early enough to properly handle setting up the krb5_service for failover and creating the krb5info files.
ACK
bye, Sumit
Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk1j9hUACgkQeiVVYja6o6N2YACfW1TQKx3nOUU6C8UT5KbWNXEi MZ0An1W8nHKxqTqo+w2mEuI46wPLVXmY =9Yio -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 02/22/2011 03:17 PM, Sumit Bose wrote:
On Tue, Feb 22, 2011 at 12:44:53PM -0500, Stephen Gallagher wrote: On 02/22/2011 12:10 PM, Sumit Bose wrote:
Sorry, I just realized that my testing was flawed. You access options->id->basic in ipa_service_init() before it is initialized by ipa_get_id_options().
Add krb5_realm to the basic IPA options
Previously, this was only handled by the internal LDAP and Kerberos providers, but this wasn't available early enough to properly handle setting up the krb5_service for failover and creating the krb5info files.
ACK
Pushed to master and sssd-1-5
- -- Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/
sssd-devel@lists.fedorahosted.org
-
Stephen Gallagher -
Sumit Bose