From c24a4816d6575c9085d9d35b052eda4e0ea8a725 Mon Sep 17 00:00:00 2001 From: Michel Decima Date: Sun, 2 Jan 2022 13:15:37 +0100 Subject: [PATCH] feat: use DNS discovery to find Kerberos servers Rationale: when configured with /etc/krb5.conf, SSSD ignores the values of dns_lookup_kdc and dns_lookp_realm properties, ignores the static kdc servers declared in the [realms] section, and always try to find the Kerberos TGT servers using DNS _srv_ discovery, based on the realm name as search domain (which is not optimal in the Orange network). It's easier to define how to get the list of Kerberos servers from the SSSD configuration, because then you can either give a static list of servers or use DNS discovery by specifying the right search domain. If krb5_use_kdcinfo property value is true (the default), then the Kerberos servers are taken from sssd.conf, otherwise if the value is false then the servers are taken from krb5.conf --- etc/sssd/sssd.conf | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/etc/sssd/sssd.conf b/etc/sssd/sssd.conf index 43633ff..4efa46b 100644 --- a/etc/sssd/sssd.conf +++ b/etc/sssd/sssd.conf @@ -6,12 +6,14 @@ domains = ad.francetelecom.fr certificate_verification = no_ocsp services = nss + [nss] filter_users = root filter_groups = root + [pam] -pam_verbosity = 3 +pam_verbosity = 2 pam_account_expired_message = Account expired, please contact help desk. pam_account_locked_message = Account locked, please contact help desk pam_public_domains = ad.francetelecom.fr @@ -19,19 +21,26 @@ pam_cert_auth = false p11_child_timeout = 60 offline_credentials_expiration = 0 + [domain/ad.francetelecom.fr] -min_id = 1000 id_provider = files +min_id = 1000 +max_id = 60000 +# auth_provider = krb5 -chpass_provider = none -cache_credentials = true -use_fully_qualified_names = false krb5_realm = AD.FRANCETELECOM.FR krb5_auth_timeout = 10 krb5_store_password_if_offline = true krb5_lifetime = 24h krb5_renewable_lifetime = 7d krb5_renew_interval = 30m -# see /etc/krb5.conf -krb5_use_kdcinfo = false +krb5_use_kdcinfo = true +krb5_kdcinfo_lookahead = 5:2 +dns_discovery_domain = S-FT-FR-EBU._sites.ad.francetelecom.fr +# +chpass_provider = none +# +cache_credentials = true +use_fully_qualified_names = false +lookup_family_order = ipv4_only