ipa: kerberos locator plugin and AD sites - sssd 1.13.x

[Ziomek, M. (Maciej)]

Hello everyone,

I would kindly ask whether there are any plans / possibilities to port features introduced in sssd 1.16.3 back to sssd 1.13.x (LTM) ? These features are:

1. Since 1.16.3 the kdcinfo files are generated automatically also for trusted domains in setups that use id_provider=ad and IPA masters in a trust relationship with an AD domain.

2. SSSD Kerberos locator plugin can now process multiple address if SSSD generates more than one.

3. On IPA clients the AD DCs or the AD site which should be used to authenticate users can now be listed in a subdomain section.

These three mentioned features help us a lot but at the same time we are suffering from their lack in 1.13.x ( LTM ).

We are still using systems where version 1.13.x is the only one officially available.

Have a nice day,

Regards

Maciej Ziomek

ING Business Shared Services B.V. z siedzibą w Amsterdamie, Holandia, VAT PL 526-319-58-54, działająca w Polsce w formie oddziału, pod firmą ING Business Shared Services B.V. spółka z ograniczoną odpowiedzialnością Oddział w Polsce z siedzibą w Katowicach, ul. Konduktorska 35, 40-155 Katowice, NIP: 2050005130, wpisana do rejestru przedsiębiorców Krajowego Rejestru Sądowego prowadzonego przez Sąd Rejonowy Katowice-Wschód w Katowicach, VIII Wydział Gospodarczy Krajowego Rejestru Sądowego pod numerem KRS 0000702305.

[Alexey Tikhonov]

On Wed, Oct 2, 2019 at 11:39 AM Ziomek, M. (Maciej)
 wrote:
> Hello everyone,
>
> I would kindly ask whether there are any plans / possibilities to port features introduced in sssd 1.16.3 back to sssd 1.13.x (LTM) ?

I am sorry, but I don't think so. The the best of my knowledge, no
backports are planned for 1.13.x branch.
1.16.x is de-facto LTM and going to be declared as such soon.
> These features are:
>
> Since 1.16.3 the kdcinfo files are generated automatically also for trusted domains in setups that use id_provider=ad and IPA masters in a trust relationship with an AD domain.
>
> SSSD Kerberos locator plugin can now process multiple address if SSSD generates more than one.
>
> On IPA clients the AD DCs or the AD site which should be used to authenticate users can now be listed in a subdomain section.
>
> These three mentioned features help us a lot but at the same time we are suffering from their lack in 1.13.x ( LTM ).
>
> We are still using systems where version 1.13.x is the only one officially available.
>
> Have a nice day,
>
> Regards
>
> Maciej Ziomek
>
> ING Business Shared Services B.V. z siedzibą w Amsterdamie, Holandia, VAT PL 526-319-58-54, działająca w Polsce w formie oddziału, pod firmą ING Business Shared Services B.V. spółka z ograniczoną odpowiedzialnością Oddział w Polsce z siedzibą w Katowicach, ul. Konduktorska 35, 40-155 Katowice, NIP: 2050005130, wpisana do rejestru przedsiębiorców Krajowego Rejestru Sądowego prowadzonego przez Sąd Rejonowy Katowice-Wschód w Katowicach, VIII Wydział Gospodarczy Krajowego Rejestru Sądowego pod numerem KRS 0000702305.
>
> sssd-devel mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail].o...