3:36 p.m.
Also recorded in TRAC as lucky #2000
(https://fedorahosted.org/fedora-infrastructure/ticket/2000)
== Primary Contact ==
Name: Stephen Gallagher [[BR]]
Fedora Account Name: sgallagh [[BR]]
Group: Fedora Packager CVS Commit Group [[BR]]
'''Infrastructure Sponsor''':
== Secondary Contact info ==
Name: James Laska [[BR]]
Fedora Account Name: jlaska [[BR]]
Group: Fedora Packager CVS Commit Group [[BR]]
== Project Info ==
Project Name: A test box running an LDAP and kerberos server for the
2010-03-04 SSSD test day [[BR]]
Target Audience: SSSD test day participants [[BR]]
Expiration/Delivery Date (required): 2010-03-04 (this is the test day
date) [[BR]]
Description/Summary:
A kerberos and ldap server available for participants of the SSSD test
day
Project plan (Detailed):
We need both a kerberos and LDAP server available to test F-13
SSSDbyDefault changes. Specifically (provided by sgallagh):
We need Kerberos to be configured to authenticate the same users
provided by
the LDAP server, and we want the LDAP server to ALSO be able to
authenticate
these users. I'd also prefer it if the two systems could use
different
passwords (e.g. kerberos users would auth with 'krbuserN' and ldap
users
would
auth with 'ldapuserN' so we could be certain of which auth
mechanism
was being
used).
Goals:
Provide the test day participants with an easy test environment.
== Specific resources needed ==
N/A
== Additional Info (Optional) ==
I've included Stephen and Jenny to the CC list of this ticket for
further details that I may have missed.
3:45 p.m.
New subject: RFR - A kerberos and ldap server available for participants of the SSSD test day
On Tue, Feb 23, 2010 at 2:36 PM, James Laska <jlaska(a)redhat.com> wrote:
A kerberos and ldap server available for participants of the SSSD
test
day
Project plan (Detailed):
We need both a kerberos and LDAP server available to test F-13
SSSDbyDefault changes. Specifically (provided by sgallagh):
A couple of questions:
This needs to be publicly accessible versus inside of colo
The LDAP needs to be added/controlled by?
--
Stephen J Smoogen.
Ah, but a man's reach should exceed his grasp. Or what's a heaven for?
-- Robert Browning
3:56 p.m.
On Tue, 23 Feb 2010, Stephen John Smoogen wrote:
On Tue, Feb 23, 2010 at 2:36 PM, James Laska
<jlaska(a)redhat.com> wrote:
> A kerberos and ldap server available for participants of the SSSD test
> day
>
> Project plan (Detailed):
> We need both a kerberos and LDAP server available to test F-13
> SSSDbyDefault changes. Specifically (provided by sgallagh):
>
A couple of questions:
This needs to be publicly accessible versus inside of colo
The LDAP needs to be added/controlled by?
I believe they just need an external publictest server for people to hit
while testing things.
-Mike
6:42 a.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 02/23/2010 04:56 PM, Mike McGrath wrote:
On Tue, 23 Feb 2010, Stephen John Smoogen wrote:
> On Tue, Feb 23, 2010 at 2:36 PM, James Laska <jlaska(a)redhat.com> wrote:
>
>> A kerberos and ldap server available for participants of the SSSD test
>> day
>>
>> Project plan (Detailed):
>> We need both a kerberos and LDAP server available to test F-13
>> SSSDbyDefault changes. Specifically (provided by sgallagh):
>>
>
> A couple of questions:
>
> This needs to be publicly accessible versus inside of colo
> The LDAP needs to be added/controlled by?
>
I believe they just need an external publictest server for people to hit
while testing things.
-Mike
Yeah, the SSSD supports LDAP for identity lookups, LDAP and Kerberos as
authentication providers. So we want to set up an LDAP server providing
schema rfc2307 (for providing users and for doing LDAP simple bind
authentication) It needs to provide access both over LDAP/TLS and LDAPS.
Beyond that, we need a Kerberos KDC set up with user principals the same
as those provided by the LDAP server.
In a separate email thread, someone asked if FreeIPA would be acceptable
for this setup. It would make an excellent second data point, but
FreeIPA uses rfc2307bis for its schema, rather than rfc2307. This will
require a more detailed setup for this test than the basic case. I am
currently communicating with the authconfig developer to determine
whether we will be able to add the rfc2307bis option in time for the
Test Day. If so, a FreeIPA server would also be an excellent idea.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkuFHsgACgkQeiVVYja6o6MzLgCdHcYx1Kf30G4A+ZGDpdBFtozZ
A5QAnRx7tsG964olDNxFi5PEY6NI8rNS
=geEe
-----END PGP SIGNATURE-----
6:49 p.m.
Apologies, forgot to include sgallagh and jgalipea to the initial cc
list.
On Tue, 2010-02-23 at 14:45 -0700, Stephen John Smoogen wrote:
On Tue, Feb 23, 2010 at 2:36 PM, James Laska
<jlaska(a)redhat.com> wrote:
> A kerberos and ldap server available for participants of the SSSD test
> day
>
> Project plan (Detailed):
> We need both a kerberos and LDAP server available to test F-13
> SSSDbyDefault changes. Specifically (provided by sgallagh):
>
A couple of questions:
This needs to be publicly accessible versus inside of colo
Yes, this would be publicly accessible and needed only for the test day.
The LDAP needs to be added/controlled by?
I believe we may need to provide you with an initial data set to
populate. Alternatively, we request permissions so that information can
be added as we go. Stephen (cc'd) may have a preference here.
Thanks,
James
7:55 p.m.
New subject: RFR - A kerberos and ldap server available for participants of the SSSD test day
On Tue, Feb 23, 2010 at 5:49 PM, James Laska <jlaska(a)redhat.com> wrote:
Apologies, forgot to include sgallagh and jgalipea to the initial cc
list.
On Tue, 2010-02-23 at 14:45 -0700, Stephen John Smoogen wrote:
> On Tue, Feb 23, 2010 at 2:36 PM, James Laska <jlaska(a)redhat.com> wrote:
>
> > A kerberos and ldap server available for participants of the SSSD test
> > day
> >
> > Project plan (Detailed):
> > We need both a kerberos and LDAP server available to test F-13
> > SSSDbyDefault changes. Specifically (provided by sgallagh):
> >
>
> A couple of questions:
>
> This needs to be publicly accessible versus inside of colo
Yes, this would be publicly accessible and needed only for the test day.
> The LDAP needs to be added/controlled by?
I believe we may need to provide you with an initial data set to
populate. Alternatively, we request permissions so that information can
be added as we go. Stephen (cc'd) may have a preference here.
I am guessing that we would be setting up FreeIPA is what is wanted? I
am just trying to get an idea of what is needed and if how much are
wanted from infrastructure and what will be done by people. Sorry for
the many questions.
--
Stephen J Smoogen.
Ah, but a man's reach should exceed his grasp. Or what's a heaven for?
-- Robert Browning
5174
days inactive
5175
days old
infrastructure@lists.fedoraproject.org
5 comments
4 participants
participants (4)
-
James Laska -
Mike McGrath -
Stephen Gallagher -
Stephen John Smoogen