Bug 621963
| Summary: | SSSD: Document how to manually configure GSSAPI with SSSD LDAP back end | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Dmitri Pal <dpal> |
| Component: | doc-Deployment_Guide | Assignee: | Martin Prpič <mprpic> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | ecs-bugs |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 6.0 | CC: | dpal, jgalipea, jhrozek, jskeoch, marcus.moeller, sbose, sgallagh, ssorce |
| Target Milestone: | rc | Keywords: | Documentation |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 621541 | Environment: | |
| Last Closed: | 2011-05-25 11:51:52 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 621541 | ||
| Bug Blocks: | |||
|
Description
Dmitri Pal
2010-08-06 16:09:00 UTC
I did not even create a krb5.conf in first stage as I thought it's no longer necessary with sssd Of course, afterwards, to receive the TGT manually, I had to create one. Besides that I want to use service discovery via DNS for both, LDAP and KDC, so I left them out in sssd.conf, now. In krb5.conf I did not specify KDC(s) but dns_lookup_kdc. Marcus, we plan to fix this upstream and include it in the SSSD 1.4.0 release. This is just to document the issue and workaround for RHEL 6.0 (In reply to comment #2) > I did not even create a krb5.conf in first stage as I thought it's no longer > necessary with sssd > I wasn't implying that you needed to create one - it should not be necessary for GSSAPI bind to work - I was just trying to confirm my theory. Creating a krb5.conf is just a workaround that tells libkrb the needed properties such as KDCs. When the fix is implemented, it should no longer be needed for this use case. Is the kdcinfo file only created once or do I have to renew the TGT regularly? (In reply to comment #5) > Is the kdcinfo file only created once or do I have to renew the TGT regularly? That should be totally transparent and handled by the SSSD. No manual intervention needed. So it's only necessary to have a valid krb5.conf present, not to fetch a TGT manually? Correct. SSSD performs the kinit internally. Okay, as mentioned before, I have now set up sssd to use service discovery for both, LDAP and krb which works if a krb5.conf with at least one kdc is present. If I remove the kdc entry from krb5.conf and enable dns_lookup_kdc instead I get an error like: (Mon Aug 9 20:17:44 2010) [[sssd[ldap_child[5750]]]] [ldap_child_get_tgt_sync] (4): Principal name is: [spn/hosth@MYDOMAIN] (Mon Aug 9 20:17:45 2010) [[sssd[ldap_child[5750]]]] [ldap_child_get_tgt_sync] (0): Failed to init credentials: KDC has no support for encryption type Best Regards Marcus Ah, verify_ap_req_nofail = false was missing :) kdc service discovery with sssd 1.4.0 does not seem to work. ccache is not retreived if no krb5_kdcip is given. (In reply to comment #11) > kdc service discovery with sssd 1.4.0 does not seem to work. > > ccache is not retreived if no krb5_kdcip is given. Please attach your (sanitized) sssd.conf. ah, had to set dns_discrovery_domain because of a variant hostname. I'll go through all this info and add to SSSD section of the RHEL Deployment Guide. Reassigning to default as per discussion with dept leaders. |