On Wed, Feb 17, 2016 at 05:44:51PM +0100, Sumit Bose wrote: > Hi, > > if a different keytab than /etc/krb5.keytab is used e.g. with the AD > provider the subdomains still try to use keys from /etc/krb5.keytab to > connect to e.g. the LDAP server of the subdomain. But id > /etc/krb5.keytab is not present or does not contain suitable keys this > will fails. As a work-around it might be possible to change > default_keytab_name in /etc/krb5.conf but this will change the default > globally and only works for a single file. If e.g. there are 2 AD > domains with alternative keytabs configured this won't work. > > The attached patch allows to inherit the setting of ldap_krb5_keytab (or > krb5_keytab) to the subdomains.
The patch is of course correct (I'm just running CI tests now), but I wonder what is the use-case? I thought that since the subdomains were trusting each other in a direct integration scenario, we could always use the keys from the main domain we're enrolled with? Also, is this something we should file a ticket for so that downstreams can be aware of this possibility? _______________________________________________ sssd-devel mailing list [email protected] https://lists.fedorahosted.org/admin/lists/[email protected]
