Hi list,
I've tried to use sssd with heimdal, there were some fixes to be done. Are you intrested in reviewing and integrating them?
They are available at: https://git.bnfr.net/sssd/log/?h=heimdal-1 Note: They are on top of other build fixes i've send to the list (but thats visible in the log).
This compiles without warnings and passes all make tests. Actually i've added alternatives for deprecated (in terms of heimdal) kerberos functions to avoid warnings there.
I've tested this in a samba 4 environment (with the sssd-ad module).
Regards, Ben
On Thu, Oct 17, 2013 at 01:35:08PM +0200, Benjamin Franzke wrote:
Hi list,
I've tried to use sssd with heimdal, there were some fixes to be done. Are you intrested in reviewing and integrating them?
They are available at: https://git.bnfr.net/sssd/log/?h=heimdal-1 Note: They are on top of other build fixes i've send to the list (but thats visible in the log).
This compiles without warnings and passes all make tests. Actually i've added alternatives for deprecated (in terms of heimdal) kerberos functions to avoid warnings there.
I've tested this in a samba 4 environment (with the sssd-ad module).
Regards, Ben
Hi Ben,
I'm interested in merging the patches as long as they don't break MIT support, just please note that there is no Heimdal on Fedora and so far most upstream developers run Fedora or RHEL, so testing from our side would be a bit limited.
2013/10/17 Jakub Hrozek jhrozek@redhat.com
On Thu, Oct 17, 2013 at 01:35:08PM +0200, Benjamin Franzke wrote:
Hi list,
I've tried to use sssd with heimdal, there were some fixes to be done. Are you intrested in reviewing and integrating them?
They are available at: https://git.bnfr.net/sssd/log/?h=heimdal-1 Note: They are on top of other build fixes i've send to the list (but
thats
visible in the log).
This compiles without warnings and passes all make tests. Actually i've added alternatives for deprecated (in terms of heimdal) kerberos functions to avoid warnings there.
I've tested this in a samba 4 environment (with the sssd-ad module).
Regards, Ben
Hi Ben,
I'm interested in merging the patches as long as they don't break MIT support,
I see. There is one functional change: "heimdal: Change password using krb5_set_password" This applied to both mit-krb5 and heimdal. And I have to admit I did not yet test password changing with it. Will do.
just please note that there is no Heimdal on Fedora and so far
most upstream developers run Fedora or RHEL, so testing from our side would be a bit limited.
_______________________________________________
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 10/17/2013 07:35 AM, Benjamin Franzke wrote:
Hi list,
I've tried to use sssd with heimdal, there were some fixes to be done. Are you intrested in reviewing and integrating them?
They are available at: https://git.bnfr.net/sssd/log/?h=heimdal-1 Note: They are on top of other build fixes i've send to the list (but thats visible in the log).
This compiles without warnings and passes all make tests. Actually i've added alternatives for deprecated (in terms of heimdal) kerberos functions to avoid warnings there.
I've tested this in a samba 4 environment (with the sssd-ad module).
Just for the record, Heimdal support has come up before. Historically, our answer has been this: "SSSD upstream does not officially support using SSSD with Heimdal. This is because the SSSD upstream works closely with the MIT Kerberos upstream to have features that we need incorporated there."
In the past, we've allowed the community to contribute patches to work with Heimdal because there are some platforms out there that seem to prefer it, but the people who have contributed this have a habit of disappearing. We've always held to the idea that it's not the responsibility of the core upstream to maintain the Heimdal patches.
As move further along and the IPA and AD providers rely on ever-increasing MIT-specific features, I think the value of supporting Heimdal at all upstream continues to decrease.
I'd honestly prefer to propose that SSSD drops its Heimdal support entirely and stop giving the impression that it might work. If we don't do this, a secondary option would be to add a new configure flag for Heimdal usage that makes it clear that Heimdal support is largely incomplete.
I'd honestly be more interested in taking a samba-like approach here and making it possible to statically build-in a copy of MIT Kerberos for those platforms that only have Heimdal (such as the BSDs), since this would allow those platforms to enjoy all of the advance functionality that SSSD-with-MIT can offer (such as FreeIPA cross-realm trusts).
Benjamin: Please do not take this as an attack on you. This is a long-standing issue upstream and one that just keeps coming up.
2013/10/17 Stephen Gallagher sgallagh@redhat.com
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 10/17/2013 07:35 AM, Benjamin Franzke wrote:
Hi list,
I've tried to use sssd with heimdal, there were some fixes to be done. Are you intrested in reviewing and integrating them?
They are available at: https://git.bnfr.net/sssd/log/?h=heimdal-1 Note: They are on top of other build fixes i've send to the list (but thats visible in the log).
This compiles without warnings and passes all make tests. Actually i've added alternatives for deprecated (in terms of heimdal) kerberos functions to avoid warnings there.
I've tested this in a samba 4 environment (with the sssd-ad module).
Just for the record, Heimdal support has come up before. Historically, our answer has been this: "SSSD upstream does not officially support using SSSD with Heimdal. This is because the SSSD upstream works closely with the MIT Kerberos upstream to have features that we need incorporated there."
In the past, we've allowed the community to contribute patches to work with Heimdal because there are some platforms out there that seem to prefer it, but the people who have contributed this have a habit of disappearing. We've always held to the idea that it's not the responsibility of the core upstream to maintain the Heimdal patches.
As move further along and the IPA and AD providers rely on ever-increasing MIT-specific features, I think the value of supporting Heimdal at all upstream continues to decrease.
I'd honestly prefer to propose that SSSD drops its Heimdal support entirely and stop giving the impression that it might work. If we don't do this, a secondary option would be to add a new configure flag for Heimdal usage that makes it clear that Heimdal support is largely incomplete.
I'd honestly be more interested in taking a samba-like approach here and making it possible to statically build-in a copy of MIT Kerberos for those platforms that only have Heimdal (such as the BSDs), since this would allow those platforms to enjoy all of the advance functionality that SSSD-with-MIT can offer (such as FreeIPA cross-realm trusts).
Benjamin: Please do not take this as an attack on you. This is a long-standing issue upstream and one that just keeps coming up.
No problem ;) I understand that position. My main motivation was to be able to build it on my main machine (gentoo) where i have samba4 installed as well. So that i can read the sssd man pages here.
Also I think that if you dont want to support heimdal, maybe there should be a configure check that errors out if people try to compile against heimdal.
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlJfzsoACgkQeiVVYja6o6OWPgCcCkEjBvjhQBaZgjr6RAmYJTpv zc8Anj140fym0/O1SHT7kFIKL0cRTx4o =KyJ4 -----END PGP SIGNATURE----- _______________________________________________ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
On (17/10/13 13:59), Benjamin Franzke wrote:
2013/10/17 Stephen Gallagher sgallagh@redhat.com
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 10/17/2013 07:35 AM, Benjamin Franzke wrote:
Hi list,
I've tried to use sssd with heimdal, there were some fixes to be done. Are you intrested in reviewing and integrating them?
They are available at: https://git.bnfr.net/sssd/log/?h=heimdal-1 Note: They are on top of other build fixes i've send to the list (but thats visible in the log).
This compiles without warnings and passes all make tests. Actually i've added alternatives for deprecated (in terms of heimdal) kerberos functions to avoid warnings there.
I've tested this in a samba 4 environment (with the sssd-ad module).
Just for the record, Heimdal support has come up before. Historically, our answer has been this: "SSSD upstream does not officially support using SSSD with Heimdal. This is because the SSSD upstream works closely with the MIT Kerberos upstream to have features that we need incorporated there."
In the past, we've allowed the community to contribute patches to work with Heimdal because there are some platforms out there that seem to prefer it, but the people who have contributed this have a habit of disappearing. We've always held to the idea that it's not the responsibility of the core upstream to maintain the Heimdal patches.
As move further along and the IPA and AD providers rely on ever-increasing MIT-specific features, I think the value of supporting Heimdal at all upstream continues to decrease.
I'd honestly prefer to propose that SSSD drops its Heimdal support entirely and stop giving the impression that it might work. If we don't do this, a secondary option would be to add a new configure flag for Heimdal usage that makes it clear that Heimdal support is largely incomplete.
I'd honestly be more interested in taking a samba-like approach here and making it possible to statically build-in a copy of MIT Kerberos for those platforms that only have Heimdal (such as the BSDs), since this would allow those platforms to enjoy all of the advance functionality that SSSD-with-MIT can offer (such as FreeIPA cross-realm trusts).
Benjamin: Please do not take this as an attack on you. This is a long-standing issue upstream and one that just keeps coming up.
No problem ;) I understand that position. My main motivation was to be able to build it on my main machine (gentoo) where i have samba4 installed as well. So that i can read the sssd man pages here.
Also I think that if you dont want to support heimdal, maybe there should be a configure check that errors out if people try to compile against heimdal.
Or you can try to update samba4 portage with possibility to compile with MIT krb5 :-)
LS
2013/10/17 Lukas Slebodnik lslebodn@redhat.com
On (17/10/13 13:59), Benjamin Franzke wrote:
2013/10/17 Stephen Gallagher sgallagh@redhat.com
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 10/17/2013 07:35 AM, Benjamin Franzke wrote:
Hi list,
I've tried to use sssd with heimdal, there were some fixes to be done. Are you intrested in reviewing and integrating them?
They are available at: https://git.bnfr.net/sssd/log/?h=heimdal-1 Note: They are on top of other build fixes i've send to the list (but thats visible in the log).
This compiles without warnings and passes all make tests. Actually i've added alternatives for deprecated (in terms of heimdal) kerberos functions to avoid warnings there.
I've tested this in a samba 4 environment (with the sssd-ad module).
Just for the record, Heimdal support has come up before. Historically, our answer has been this: "SSSD upstream does not officially support using SSSD with Heimdal. This is because the SSSD upstream works closely with the MIT Kerberos upstream to have features that we need incorporated there."
In the past, we've allowed the community to contribute patches to work with Heimdal because there are some platforms out there that seem to prefer it, but the people who have contributed this have a habit of disappearing. We've always held to the idea that it's not the responsibility of the core upstream to maintain the Heimdal patches.
As move further along and the IPA and AD providers rely on ever-increasing MIT-specific features, I think the value of supporting Heimdal at all upstream continues to decrease.
I'd honestly prefer to propose that SSSD drops its Heimdal support entirely and stop giving the impression that it might work. If we don't do this, a secondary option would be to add a new configure flag for Heimdal usage that makes it clear that Heimdal support is largely incomplete.
I'd honestly be more interested in taking a samba-like approach here and making it possible to statically build-in a copy of MIT Kerberos for those platforms that only have Heimdal (such as the BSDs), since this would allow those platforms to enjoy all of the advance functionality that SSSD-with-MIT can offer (such as FreeIPA cross-realm trusts).
Benjamin: Please do not take this as an attack on you. This is a long-standing issue upstream and one that just keeps coming up.
No problem ;) I understand that position. My main motivation was to be able to build it on my main machine (gentoo) where i have samba4 installed as well. So that i can read the sssd man pages here.
Also I think that if you dont want to support heimdal, maybe there should be a configure check that errors out if people try to compile against heimdal.
Or you can try to update samba4 portage with possibility to compile with MIT krb5 :-)
Yes, with samba4 client side, but I wanted DC support, and updating heimdal support in sssd was easier than trying to do this:
http://gitweb.samba.org/?p=samba.git;a=blob;f=source4/auth/kerberos/kerberos...
LS _______________________________________________ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
On Thu, Oct 17, 2013 at 02:18:57PM +0200, Benjamin Franzke wrote:
2013/10/17 Lukas Slebodnik lslebodn@redhat.com
On (17/10/13 13:59), Benjamin Franzke wrote:
2013/10/17 Stephen Gallagher sgallagh@redhat.com
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 10/17/2013 07:35 AM, Benjamin Franzke wrote:
Hi list,
I've tried to use sssd with heimdal, there were some fixes to be done. Are you intrested in reviewing and integrating them?
They are available at: https://git.bnfr.net/sssd/log/?h=heimdal-1 Note: They are on top of other build fixes i've send to the list (but thats visible in the log).
This compiles without warnings and passes all make tests. Actually i've added alternatives for deprecated (in terms of heimdal) kerberos functions to avoid warnings there.
I've tested this in a samba 4 environment (with the sssd-ad module).
Just for the record, Heimdal support has come up before. Historically, our answer has been this: "SSSD upstream does not officially support using SSSD with Heimdal. This is because the SSSD upstream works closely with the MIT Kerberos upstream to have features that we need incorporated there."
In the past, we've allowed the community to contribute patches to work with Heimdal because there are some platforms out there that seem to prefer it, but the people who have contributed this have a habit of disappearing. We've always held to the idea that it's not the responsibility of the core upstream to maintain the Heimdal patches.
As move further along and the IPA and AD providers rely on ever-increasing MIT-specific features, I think the value of supporting Heimdal at all upstream continues to decrease.
I'd honestly prefer to propose that SSSD drops its Heimdal support entirely and stop giving the impression that it might work. If we don't do this, a secondary option would be to add a new configure flag for Heimdal usage that makes it clear that Heimdal support is largely incomplete.
I'd honestly be more interested in taking a samba-like approach here and making it possible to statically build-in a copy of MIT Kerberos for those platforms that only have Heimdal (such as the BSDs), since this would allow those platforms to enjoy all of the advance functionality that SSSD-with-MIT can offer (such as FreeIPA cross-realm trusts).
Benjamin: Please do not take this as an attack on you. This is a long-standing issue upstream and one that just keeps coming up.
No problem ;) I understand that position. My main motivation was to be able to build it on my main machine (gentoo) where i have samba4 installed as well. So that i can read the sssd man pages here.
Also I think that if you dont want to support heimdal, maybe there should be a configure check that errors out if people try to compile against heimdal.
Or you can try to update samba4 portage with possibility to compile with MIT krb5 :-)
Yes, with samba4 client side, but I wanted DC support, and updating heimdal support in sssd was easier than trying to do this:
http://gitweb.samba.org/?p=samba.git;a=blob;f=source4/auth/kerberos/kerberos...
I still think it would be nice to get some Heimdal support in. There was a user on #sssd asking about Heimdal today which reminded me of this thread. Also, SSSD is finding its way into more exotic OSs (FreeNAS recently)
Benajmin, are you interested in re-sending the patches?
I think we could also add 1) a configure switch that would make the user explicitly select Heimdal 2) Add a loud (level 0) DEBUG message that would be printed on startup and warn the user that Heimdal is not tested by upstream.
Then we could, if we suspected a reported problem is caused by Heimdal which we can't test on Fedora, just relay the user to his distribution's bug tracker.
On Thu, 2013-10-17 at 07:49 -0400, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 10/17/2013 07:35 AM, Benjamin Franzke wrote:
Hi list,
I've tried to use sssd with heimdal, there were some fixes to be done. Are you intrested in reviewing and integrating them?
They are available at: https://git.bnfr.net/sssd/log/?h=heimdal-1 Note: They are on top of other build fixes i've send to the list (but thats visible in the log).
This compiles without warnings and passes all make tests. Actually i've added alternatives for deprecated (in terms of heimdal) kerberos functions to avoid warnings there.
I've tested this in a samba 4 environment (with the sssd-ad module).
Just for the record, Heimdal support has come up before. Historically, our answer has been this: "SSSD upstream does not officially support using SSSD with Heimdal. This is because the SSSD upstream works closely with the MIT Kerberos upstream to have features that we need incorporated there."
In the past, we've allowed the community to contribute patches to work with Heimdal because there are some platforms out there that seem to prefer it, but the people who have contributed this have a habit of disappearing. We've always held to the idea that it's not the responsibility of the core upstream to maintain the Heimdal patches.
As move further along and the IPA and AD providers rely on ever-increasing MIT-specific features, I think the value of supporting Heimdal at all upstream continues to decrease.
I'd honestly prefer to propose that SSSD drops its Heimdal support entirely and stop giving the impression that it might work. If we don't do this, a secondary option would be to add a new configure flag for Heimdal usage that makes it clear that Heimdal support is largely incomplete.
I'd honestly be more interested in taking a samba-like approach here and making it possible to statically build-in a copy of MIT Kerberos for those platforms that only have Heimdal (such as the BSDs), since this would allow those platforms to enjoy all of the advance functionality that SSSD-with-MIT can offer (such as FreeIPA cross-realm trusts).
Benjamin: Please do not take this as an attack on you. This is a long-standing issue upstream and one that just keeps coming up.
I honestly see no problem maintaining experimental Heimdal support as long as it is clearly documented that it is experimental.
Of course it must not break the primary library code, but beyond that I see no damage in attempting to be friendly to distributions that choose a different implementartion.
I am completely against the idea of embedding the Kerberos distribution into SSSD, it was a very bad idea for Samba and would be for SSSD too. A system can't really successfully use multiple implementations at the same time except for specific carefully controlled cases, the "advanced functionality" that SSSD-with-MIT would provide would probably amount to just broken applications when credential caches formats do not match. So, no thank you.
Simo.
sssd-devel@lists.fedorahosted.org
-
Benjamin Franzke -
Jakub Hrozek -
Lukas Slebodnik -
Simo Sorce -
Stephen Gallagher