[PATCH] Don't ucase configured realm

Matthias Dieter Wallnöfer mdw at samba.org
Tue Mar 9 00:10:46 MST 2010


It's not only this. Sometimes we divide correctly between DNS domainname 
(szRealm_lower) and realm (szRealm_upper) but not always (e.g. we could 
take an upcased DNS domainame as the realm). It is a huge task to review 
and check all occurences of those calls. Plus, since you keep the realm 
case-sensitive that means you are not really standard-AD compatible.

Matthias

Benjamin Coddington wrote:
> In the Samba4 case, is this because it is already broken out into 
> szRealm_upper and szRealm_lower, where szRealm_lower is used as 
> lp_dnsdomain?  Could not the "respect case" case only modify 
> szRealm_upper?  What is the difficult part for Samba 4?
>
> Ben
>
> On 3/8/10 11:55 AM, Matthias Dieter Wallnöfer wrote:
>> Hi Benjamin,
>>
>> SAMBA 3 might accept such a change - we at the SAMBA 4 side for sure not
>> (it would require such an amount of work to change this - nearly
>> undoable). And as Andrew Bartlett stated here: also the "real AD"
>> upcases always the realm.
>>
>> Greets,
>> Matthias
>>
>> Benjamin Coddington wrote:
>>> On 3/4/10 4:38 PM, Andrew Bartlett wrote:
>>>> On Thu, 2010-03-04 at
>>>> 11:45 -0500, Benjamin Coddington wrote:
>>>>> Hi everyone. We are one of the few that need to preserve case in
>>>>> kerberos realm names. The following seems to make sense -
>>>>> administrators ought to use the proper case when configuring a realm
>>>>> name.
>>>>
>>>> Unfortunately, far more administrators don't know the proper case.
>>>> Active Directory forces to upper case, and creates little 
>>>> distinction in
>>>> the administrators minds between lower case dns domains and upper case
>>>> realms. If we were to apply this patch, many existing sites would
>>>> break, while others would have to chase down strange and unusual 
>>>> errors
>>>> like 'reply from KDC does not match expections' trying to make things
>>>> work.
>>>>
>>>> The solution for your use in an MIT realm (I presume) will need
>>>> particular care.
>>>>
>>>> I'm sorry it's not so simple,
>>>>
>>>> Andrew Bartlett
>>>
>>> Would you accept a change to add an option to respect realm case?
>>>
>>> Ben
>>>
>>
>



More information about the samba-technical mailing list