diff options
| author | Jan Zeleny <jzeleny@redhat.com> | 2011-03-29 02:46:25 -0400 |
|---|---|---|
| committer | Stephen Gallagher <sgallagh@redhat.com> | 2011-04-25 08:06:34 -0400 |
| commit | e81a816cddab4a62f263d1a0274d5d3f101e8e0f (patch) | |
| tree | de3d6baa2ac2d39c4d50d1ce5a911e435dc0e3a9 /src/util/sss_krb5.h | |
| parent | d03617ab9106c14b46ab3dc85d5c8ced393da533 (diff) | |
| download | sssd-e81a816cddab4a62f263d1a0274d5d3f101e8e0f.tar.gz sssd-e81a816cddab4a62f263d1a0274d5d3f101e8e0f.tar.xz sssd-e81a816cddab4a62f263d1a0274d5d3f101e8e0f.zip | |
Modify principal selection for keytab authentication
Currently we construct the principal as host/fqdn@REALM. The problem
with this is that this principal doesn't have to be in the keytab. In
that case the provider fails to start. It is better to scan the keytab
and find the most suitable principal to use. Only in case no suitable
principal is found the backend should fail to start.
The second issue solved by this patch is that the realm we are
authenticating the machine to can be in general different from the realm
our users are part of (in case of cross Kerberos trust).
The patch adds new configuration option SDAP_SASL_REALM.
https://fedorahosted.org/sssd/ticket/781
Diffstat (limited to 'src/util/sss_krb5.h')
| -rw-r--r-- | src/util/sss_krb5.h | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/src/util/sss_krb5.h b/src/util/sss_krb5.h index f25f3285b..d17bfe969 100644 --- a/src/util/sss_krb5.h +++ b/src/util/sss_krb5.h @@ -64,6 +64,14 @@ krb5_error_code find_principal_in_keytab(krb5_context ctx, const char *pattern_realm, krb5_principal *princ); +errno_t select_principal_from_keytab(TALLOC_CTX *mem_ctx, + const char *hostname, + const char *desired_realm, + const char *keytab_name, + char **_principal, + char **_primary, + char **_realm); + #ifndef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_EXPIRE_CALLBACK typedef void krb5_expire_callback_func(krb5_context context, void *data, krb5_timestamp password_expiration, |