Hi, if a different keytab than /etc/krb5.keytab is used e.g. with the AD provider the subdomains still try to use keys from /etc/krb5.keytab to connect to e.g. the LDAP server of the subdomain. But id /etc/krb5.keytab is not present or does not contain suitable keys this will fails. As a work-around it might be possible to change default_keytab_name in /etc/krb5.conf but this will change the default globally and only works for a single file. If e.g. there are 2 AD domains with alternative keytabs configured this won't work.
The attached patch allows to inherit the setting of ldap_krb5_keytab (or krb5_keytab) to the subdomains. bye, Sumit
From d323a89b692e481d9c47c47d35c15d19bf9d2089 Mon Sep 17 00:00:00 2001 From: Sumit Bose <[email protected]> Date: Wed, 17 Feb 2016 16:40:57 +0100 Subject: [PATCH] subdomains: inherit ldap_krb5_keytab If a non-default keytab is configured for the parent domain the subdomains will still use the default keytab because the alternative keytab is not inherited. As a consequence SSSD might not be able to connect to services in the subdomain because the default keytab is either not present or does not have suitable keys. --- src/man/sssd.conf.5.xml | 4 ++++ src/providers/ldap/sdap.c | 1 + 2 files changed, 5 insertions(+) diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml index e03580bf7814c8e3a297dcfbcb5b50092cc3a8c7..c6ed2e0eefdac701168c71c975c55787ec6fb6c3 100644 --- a/src/man/sssd.conf.5.xml +++ b/src/man/sssd.conf.5.xml @@ -530,6 +530,10 @@ ldap_user_principal </para> <para> + ldap_krb5_keytab (the value of krb5_keytab will be + used if ldap_krb5_keytab is not set explicitly) + </para> + <para> Example: <programlisting> subdomain_inherit = ldap_purge_cache_timeout diff --git a/src/providers/ldap/sdap.c b/src/providers/ldap/sdap.c index f9b9ff7e6913c406547f36d341300b936e121693..55ba6702af396c6fac3986d254e726b6372586ce 100644 --- a/src/providers/ldap/sdap.c +++ b/src/providers/ldap/sdap.c @@ -250,6 +250,7 @@ static void sdap_inherit_basic_options(char **inherit_opt_list, int inherit_options[] = { SDAP_PURGE_CACHE_TIMEOUT, SDAP_AD_USE_TOKENGROUPS, + SDAP_KRB5_KEYTAB, SDAP_OPTS_BASIC /* sentinel */ }; int i; -- 2.1.0
_______________________________________________ sssd-devel mailing list [email protected] https://lists.fedorahosted.org/admin/lists/[email protected]
