URL: https://github.com/SSSD/sssd/pull/5486 Title: #5486: krb5: allow to use subdomain realm during authentication sumit-bose commented: """ Hi, thank you for the pull-request. Can you explain your use-case a bit more detailed? As a general comment, you cannot use `krb5_ctx` here. `krb5_ctx` holds the general configuration of the krb5_provider and is used by all requests. If there are two request running in parallel one might overwrite the `realm` value the other request just set. Maybe you can add a realm member to `struct handle_child_state` and use this to set the realm in the command line option for krb5_child? bye, Sumit """ See the full comment at https://github.com/SSSD/sssd/pull/5486#issuecomment-771433730

URL: https://github.com/SSSD/sssd/pull/5486 Title: #5486: krb5: allow to use subdomain realm during authentication mastersin commented: """ I rewrite code and don't modify krb5_ctx now. More details for my use-case: * We have special migration process to using SambaDC as domain controller: * original domain on WindowsDC * Samba domain with 2way trusts to original domain * Linux clients joins to Samba domain * original domain users logins via sssd on Linux clients * For original domain users with upnSuffixes we have a problem: * Samba KDC don't support authentication with enterprise upns fully due it don't know about upnSuffixes in trusted domain * So, instead of answer WRONG REALM it reverts "not found in Kerberos database" * Solution for this serverside problem on client for users from trusted domain is not using WindowsDC indirectly (via libkrb5 process for enterprise user principal names) by Samba KDC, but send kerberos requests to WindowsDC directly Option krb5_use_subdomain_realm allows to krb5 provider use subdomain realm for kerberos requests to trusted domain KDC directly. """ See the full comment at https://github.com/SSSD/sssd/pull/5486#issuecomment-771635250

URL: https://github.com/SSSD/sssd/pull/5486 Author: mastersin Title: #5486: krb5: allow to use subdomain realm during authentication Action: synchronized To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5486/head:pr5486 git checkout pr5486

URL: https://github.com/SSSD/sssd/pull/5486 Title: #5486: krb5: allow to use subdomain realm during authentication Label: +Accepted

URL: https://github.com/SSSD/sssd/pull/5486 Title: #5486: krb5: allow to use subdomain realm during authentication pbrezina commented: """ Pushed PR: https://github.com/SSSD/sssd/pull/5486 * `master` * 5892c3676b4e3b57693504eef574dd3cd4af543f - krb5: allow to use subdomain realm during authentication """ See the full comment at https://github.com/SSSD/sssd/pull/5486#issuecomment-773292565

URL: https://github.com/SSSD/sssd/pull/5486 Title: #5486: krb5: allow to use subdomain realm during authentication Label: -Accepted

URL: https://github.com/SSSD/sssd/pull/5486 Author: mastersin Title: #5486: krb5: allow to use subdomain realm during authentication Action: closed To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5486/head:pr5486 git checkout pr5486