From 2da6d6e7460b932f406b7f0632320433f9f98a85 Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Wed, 15 Feb 2012 17:06:54 +0100 Subject: Don't set delegation flag in client, we're using S4U2Proxy now A forwardable ticket is still required but we no longer need to send the TGT to the IPA server. A new flag, --delegate, is available if the old behavior is required. Set the minimum n-v-r for mod_auth_kerb and krb5-server to pick up needed patches for S4U2Proxy to work. https://fedorahosted.org/freeipa/ticket/1098 https://fedorahosted.org/freeipa/ticket/2246 --- ipalib/plugable.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'ipalib/plugable.py') diff --git a/ipalib/plugable.py b/ipalib/plugable.py index e0b6e7f9..4d001102 100644 --- a/ipalib/plugable.py +++ b/ipalib/plugable.py @@ -530,6 +530,9 @@ class API(DictProxy): parser.add_option('-d', '--debug', action='store_true', help='Produce full debuging output', ) + parser.add_option('--delegate', action='store_true', + help='Delegate the TGT to the IPA server', + ) parser.add_option('-v', '--verbose', action='count', help='Produce more verbose output. A second -v displays the XML-RPC request', ) @@ -570,7 +573,7 @@ class API(DictProxy): pass overrides[str(key.strip())] = value.strip() for key in ('conf', 'debug', 'verbose', 'prompt_all', 'interactive', - 'fallback'): + 'fallback', 'delegate'): value = getattr(options, key, None) if value is not None: overrides[key] = value -- cgit