Set default krb5 options in KDCHost#230
Conversation
Summary of ChangesHello @madhuriupadhye, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request enhances the robustness of SSSD configurations that utilize Kerberos authentication. It introduces a mechanism within the Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
The pull request effectively addresses the issue of missing krb5 options when auth_provider=krb5 is used in SSSD. By using setdefault, the code ensures that krb5_realm, krb5_server, and krb5_kpasswd are automatically populated with sensible defaults from the KDC host's realm and hostname if they are not explicitly provided in the configuration. This is a robust and clean solution that prevents SSSD failures and improves the usability of the KDCHost class. The change is well-documented with a clear comment explaining its purpose.
jakub-vavra-cz
left a comment
jakub-vavra-cz
left a comment
There was a problem hiding this comment.
Hi,
setting client configuration from here kdc does not make much sense.
We want the configuration set only when needed and to the right values based on which krb backend we use.
I think it would be better to have a helper like from here:
#228
The method krb_provider will set:
auth_provider=krb5 and populate the krb5_realm krb5_server krb5_server based on selected backend from (kcm, ipa, ad).
madhuriupadhye
force-pushed
the
kdc_fix
branch
2 times, most recently
from
b08d07f to
5dce6a5
Compare
| host = backend.host | ||
| host.client.setdefault("auth_provider", "krb5") | ||
| host.client.setdefault("krb5_realm", host.realm) | ||
| host.client.setdefault("krb5_server", host.hostname) | ||
| host.client.setdefault("krb5_kpasswd", host.hostname) |
There was a problem hiding this comment.
Tox is unhappy here and it is correct.
sssd_test_framework/utils/sssd.py:883: error: "BaseHost" has no attribute "client" [attr-defined]
sssd_test_framework/utils/sssd.py:884: error: "BaseHost" has no attribute "client" [attr-defined]
sssd_test_framework/utils/sssd.py:884: error: "BaseHost" has no attribute "realm" [attr-defined]
sssd_test_framework/utils/sssd.py:885: error: "BaseHost" has no attribute "client" [attr-defined]
sssd_test_framework/utils/sssd.py:886: error: "BaseHost" has no attribute "client" [attr-defined]
The generic provider uses BaseHost that has no attribute client as that one is added in BaseDomainHost.
I would try something like this instead:
| host = backend.host | |
| host.client.setdefault("auth_provider", "krb5") | |
| host.client.setdefault("krb5_realm", host.realm) | |
| host.client.setdefault("krb5_server", host.hostname) | |
| host.client.setdefault("krb5_kpasswd", host.hostname) | |
| self.sssd.domain["auth_provider"] = "krb5" | |
| self.sssd.domain["krb5_realm"] = backend.realm | |
| self.sssd.domain["krb5_server"] = backend.host.hostname | |
| self.sssd.domain["krb5_kpasswd"] = backend.host.hostname |
jakub-vavra-cz
left a comment
jakub-vavra-cz
left a comment
There was a problem hiding this comment.
The tox is corretly pointing out an issue. See inline.
madhuriupadhye
force-pushed
the
kdc_fix
branch
3 times, most recently
from
35f31b1 to
a88d060
Compare
When auth_provider=krb5 is used, SSSD requires krb5_realm, krb5_server, and krb5_kpasswd options, otherwise SSSD would fail with "Missing krb5_realm option!". Adds krb_provider() method in SSSDCommonConfiguration that sets default krb5 options (auth_provider, krb5_realm, krb5_server, krb5_kpasswd) from the backend's host configuration. Uses setdefault() to preserve explicit config values Called by krb5_auth() to reduce boilerplate in YAML configs Works with KDC, IPA, and AD backends Signed-off-by: Madhuri Upadhye <mupadhye@redhat.com>
madhuriupadhye
force-pushed
the
kdc_fix
branch
from
a88d060 to
2b82faf
Compare
2 participants
When auth_provider=krb5 is used, SSSD requires krb5_realm, krb5_server, and krb5_kpasswd options, otherwise SSSD would fail with "Missing krb5_realm option!".
This change automatically sets these defaults from the KDC host's existing realm and hostname if not provided in config. Existing configs with explicit values are unaffected.