From b9c563c29243291f40489bb0dcbf3946fca72d58 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Mon, 1 Aug 2016 12:52:07 +0200 Subject: KCM: Initial responder build and packaging MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds the initial build of the Kerberos Cache Manager responder (KCM). This is a deamon that is capable of holding and storing Kerberos ccaches. When KCM is used, the kerberos libraries (invoked through e.g. kinit) are referred to as a 'client' and the KCM deamon is referred to as 'server'. At the moment, only the Heimdal implementation of Kerberos implements the KCM server: https://www.h5l.org/manual/HEAD/info/heimdal/Credential-cache-server-_002d-KCM.html This patch adds a KCM server to SSSD. In MIT, only the 'client-side' support was added: http://k5wiki.kerberos.org/wiki/Projects/KCM_client This page also describes the protocol between the client and the server. The client is capable of talking to the server over either UNIX sockets (Linux, most Unixes) or Mach RPC (macOS). Our server only implements the UNIX sockets way and should be socket-activated by systemd, although can in theory be also ran explicitly. The KCM server only builds if the configuration option "--with-kcm" is enabled. It is packaged in a new subpackage sssd-kcm in order to allow distributions to enable the KCM credential caches by installing this subpackage only, without the rest of the SSSD. The sssd-kcm subpackage also includes a krb5.conf.d snippet that allows the admin to just uncomment the KCM defaults and instructs them to start the socket. The server can be configured in sssd.conf in the "[kcm]" section. By default, the server only listens on the same socket path the Heimdal server uses, which is "/var/run/.heim_org.h5l.kcm-socket". This is, however, configurable. The file src/responder/kcm/kcm.h is more or less directly imported from the MIT Kerberos tree, with an additional sentinel code and some comments. Not all KCM operations are implemented, only those that also the MIT client implements. That said, this KCM server should also be usable with a Heimdal client, although no special testing was with this hybrid. The patch also adds several error codes that will be used in later patches. Related to: https://pagure.io/SSSD/sssd/issue/2887 Reviewed-by: Michal Židek Reviewed-by: Simo Sorce --- src/sysv/systemd/sssd-kcm.service.in | 9 +++++++++ src/sysv/systemd/sssd-kcm.socket.in | 10 ++++++++++ 2 files changed, 19 insertions(+) create mode 100644 src/sysv/systemd/sssd-kcm.service.in create mode 100644 src/sysv/systemd/sssd-kcm.socket.in (limited to 'src/sysv') diff --git a/src/sysv/systemd/sssd-kcm.service.in b/src/sysv/systemd/sssd-kcm.service.in new file mode 100644 index 000000000..1e2bee12d --- /dev/null +++ b/src/sysv/systemd/sssd-kcm.service.in @@ -0,0 +1,9 @@ +[Unit] +Description=SSSD Kerberos Cache Manager +Documentation=man:sssd-kcm(5) + +[Install] +Also=sssd-kcm.socket + +[Service] +ExecStart=@libexecdir@/sssd/sssd_kcm --uid 0 --gid 0 --debug-to-files diff --git a/src/sysv/systemd/sssd-kcm.socket.in b/src/sysv/systemd/sssd-kcm.socket.in new file mode 100644 index 000000000..80ec1c0c8 --- /dev/null +++ b/src/sysv/systemd/sssd-kcm.socket.in @@ -0,0 +1,10 @@ +[Unit] +Description=SSSD Secrets Service responder socket +Documentation=man:sssd-kcm(8) +Requires=sssd-secrets.socket + +[Socket] +ListenStream=@localstatedir@/run/.heim_org.h5l.kcm-socket + +[Install] +WantedBy=sockets.target -- cgit