Re: [Freeipa-devel] [PATCH 1/1] Resolve external members from trusted domain via Global Catalog

2012-11-01 Thread Simo Sorce
On Wed, 2012-10-31 at 22:52 +0200, Alexander Bokovoy wrote: A sequence is following: 1. Match external member against existing trusted domain 2. Find trusted domain's domain controller and preferred GC hosts 3. Fetch trusted domain account auth info 4. Set up ccache in

[Freeipa-devel] [PATCH 1/1] Resolve external members from trusted domain via Global Catalog

2012-10-31 Thread Alexander Bokovoy
A sequence is following: 1. Match external member against existing trusted domain 2. Find trusted domain's domain controller and preferred GC hosts 3. Fetch trusted domain account auth info 4. Set up ccache in /var/run/ipa_memcached/krb5cc_TDdomain with principal ourdomain$@trusted.domain 5. Do

Re: [Freeipa-devel] [PATCH 1/1] Resolve external members from trusted domain via Global Catalog

2012-10-30 Thread Simo Sorce
On Tue, 2012-10-30 at 06:50 +0200, Alexander Bokovoy wrote: I remember in my case that was the issue, i.e. finddc did discover proper DC via DNS and returned winda.ad.local but something within SASL/krb5 library wanted to see reverse lookup working which was not set up at the point. I was

[Freeipa-devel] [PATCH 1/1] Resolve external members from trusted domain via Global Catalog

2012-10-29 Thread Alexander Bokovoy
A sequence is following: 1. Match external member against existing trusted domain 2. Find trusted domain's domain controller 3. Fetch trusted domain account auth info 4. Set up ccache in /var/run/ipa/ipa_memcached/krb5cc_TRUSTEDDOMAIN with principal ourdomain$@trusted.domain 5. Do LDAP SASL

Re: [Freeipa-devel] [PATCH 1/1] Resolve external members from trusted domain via Global Catalog

2012-10-29 Thread Simo Sorce
On Mon, 2012-10-29 at 19:59 +0200, Alexander Bokovoy wrote: A sequence is following: 1. Match external member against existing trusted domain 2. Find trusted domain's domain controller 3. Fetch trusted domain account auth info 4. Set up ccache in

Re: [Freeipa-devel] [PATCH 1/1] Resolve external members from trusted domain via Global Catalog

2012-10-29 Thread Alexander Bokovoy
On Mon, 29 Oct 2012, Simo Sorce wrote: On Mon, 2012-10-29 at 19:59 +0200, Alexander Bokovoy wrote: A sequence is following: 1. Match external member against existing trusted domain 2. Find trusted domain's domain controller 3. Fetch trusted domain account auth info 4. Set up ccache in

Re: [Freeipa-devel] [PATCH 1/1] Resolve external members from trusted domain via Global Catalog

2012-10-29 Thread Rob Crittenden
Alexander Bokovoy wrote: On Mon, 29 Oct 2012, Simo Sorce wrote: On Mon, 2012-10-29 at 19:59 +0200, Alexander Bokovoy wrote: A sequence is following: 1. Match external member against existing trusted domain 2. Find trusted domain's domain controller 3. Fetch trusted domain account auth info 4.

Re: [Freeipa-devel] [PATCH 1/1] Resolve external members from trusted domain via Global Catalog

2012-10-29 Thread Alexander Bokovoy
On Mon, 29 Oct 2012, Rob Crittenden wrote: [Mon Oct 29 16:15:33 2012] [error] [client 192.168.122.240] File /usr/lib/python2.7/site-packages/ipaserver/plugins/ldap2.py, line 562, in sasl_interactive_bind_s [Mon Oct 29 16:15:33 2012] [error] [client 192.168.122.240] return

Re: [Freeipa-devel] [PATCH 1/1] Resolve external members from trusted domain via Global Catalog

2012-10-29 Thread Simo Sorce
On Mon, 2012-10-29 at 23:03 +0200, Alexander Bokovoy wrote: On Mon, 29 Oct 2012, Simo Sorce wrote: On Mon, 2012-10-29 at 19:59 +0200, Alexander Bokovoy wrote: A sequence is following: 1. Match external member against existing trusted domain 2. Find trusted domain's domain controller 3.

Re: [Freeipa-devel] [PATCH 1/1] Resolve external members from trusted domain via Global Catalog

2012-10-29 Thread Alexander Bokovoy
On Mon, 29 Oct 2012, Simo Sorce wrote: On Mon, 2012-10-29 at 23:03 +0200, Alexander Bokovoy wrote: On Mon, 29 Oct 2012, Simo Sorce wrote: On Mon, 2012-10-29 at 19:59 +0200, Alexander Bokovoy wrote: A sequence is following: 1. Match external member against existing trusted domain 2. Find