[PATCH] Include system /etc/krb5.conf if we use MIT Kerberos
Alexander Bokovoy
ab at samba.org
Wed Nov 30 14:05:24 UTC 2016
On ke, 30 marras 2016, Andreas Schneider wrote:
> On Wednesday, 30 November 2016 15:21:03 CET Alexander Bokovoy wrote:
> > On ke, 30 marras 2016, Andreas Schneider wrote:
> > > The system /etc/krb5.conf defines some defaults like:
> > > default_ccache_name = KEYRING:persistent:%{uid}
> > >
> > > We need to respect that so should include it in our own created
> > > krb5.conf file.
> > >
> > >
> > >
> > > Review and push appreciated.
> > >
> > >
> > > Thanks,
> > >
> > > Andreas
> > >
> > > From bb8e620ce1cd97d5479440ffc84bc3abc639378d Mon Sep 17 00:00:00 2001
> > > From: Andreas Schneider <asn at samba.org>
> > > Date: Wed, 23 Nov 2016 14:39:47 +0100
> > > Subject: [PATCH 1/2] s3:param: Add an 'include system krb5 conf' option
> > >
> > > BUG: https://bugzilla.samba.org/show_bug.cgi?id=12441
> > >
> > > Signed-off-by: Andreas Schneider <asn at samba.org>
> > > ---
> > >
> > > docs-xml/smbdotconf/winbind/includesystemkrb5conf.xml | 14 ++++++++++++++
> > > source3/param/loadparm.c | 1 +
> > > 2 files changed, 15 insertions(+)
> > > create mode 100644 docs-xml/smbdotconf/winbind/includesystemkrb5conf.xml
> > >
> > > diff --git a/docs-xml/smbdotconf/winbind/includesystemkrb5conf.xml
> > > b/docs-xml/smbdotconf/winbind/includesystemkrb5conf.xml new file mode
> > > 100644
> > > index 0000000..91ac3a0
> > > --- /dev/null
> > > +++ b/docs-xml/smbdotconf/winbind/includesystemkrb5conf.xml
> > > @@ -0,0 +1,14 @@
> > > +<samba:parameter name="include system krb5 conf"
> > > + context="G"
> > > + type="boolean"
> > > + xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
> > > +<description>
> > > + <para>
> > > + Setting this parameter to <value type="example">no</value> will
> prevent
> > > + winbind to include the system /etc/krb5.conf file into the
> krb5.conf
> > > file + it creates. See also <smbconfoption name="create krb5 conf"/>.
> > > + </para>
> >
> > This does not work for Heimdal, so you should actually say that in the
> > documentation.
>
> Updated.
>
> > > +
> > > +</description>
> > > +<value type="default">yes</value>
> > > +</samba:parameter>
> > > diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
> > > index dc551eb..d8da749 100644
> > > --- a/source3/param/loadparm.c
> > > +++ b/source3/param/loadparm.c
> > > @@ -711,6 +711,7 @@ static void init_globals(struct loadparm_context
> > > *lp_ctx, bool reinit_globals)>
> > > Globals.reset_on_zero_vc = false;
> > > Globals.log_writeable_files_on_exit = false;
> > > Globals.create_krb5_conf = true;
> > >
> > > + Globals.include_system_krb5_conf = true;
> > >
> > > Globals._winbind_max_domain_connections = 1;
> > >
> > > /* hostname lookups can be very expensive and are broken on
> >
> > How this is going to include the system config? You missed 'include '
> > statement.
>
> The file contains to patches, scroll down :)
No, the problem is that your talloc_asprintf() statement has no 'include
' phrase, only file name:
>
> +#if !defined(SAMBA4_USES_HEIMDAL)
> + if (lp_include_system_krb5_conf()) {
> + include_system_krb5 = "/etc/krb5.conf";
> + }
> +#endif
> +
> file_contents =
> - talloc_asprintf(fname, "[libdefaults]\n\tdefault_realm = %s\n"
> - "%s"
> - "\tdns_lookup_realm = false\n\n"
> - "[realms]\n\t%s = {\n"
> - "%s\t}\n",
> - realm_upper, enctypes, realm_upper, kdc_ip_string);
> + talloc_asprintf(fname,
> + "[libdefaults]\n\tdefault_realm = %s\n"
> + "%s"
> + "\tdns_lookup_realm = false\n\n"
> + "[realms]\n\t%s = {\n"
> + "%s\t}\n"
> + "%s\n",
> + realm_upper,
> + enctypes,
> + realm_upper,
> + kdc_ip_string,
> + include_system_krb5);
>
You have here "%s\n" only, not "include %s\n". Either modify
include_system_krb5 to be "include /etc/krb5.conf" or do something about
the template string.
--
/ Alexander Bokovoy
More information about the samba-technical
mailing list