freeipa

#7445 Stop using /var/lib/sss/pubconf/krb5.include.d/
Closed: invalid Opened by fbarreto.

Closed: invalid
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Fedora): Bug 1544934

For some time, krb5 configuration has been put in
/var/lib/sss/pubconf/krb5.include.d.  Presumably the intent is to avoid
modifying /etc/krb5.conf directly, which I support.  However, we have for some
time been providing /etc/krb5.conf.d for these files - so there's no need to
add your own directory.
Please stop using /var/lib/sss/pubconf/krb5.include.d/ entirely in favor of
/etc/krb5.conf.

Metadata Update from @fbarreto:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1544934

Sorry, but we cannot do that completely.

SSSD generates CA paths configuration and other settings dynamically based on the state of a configuration of IPA trusts. This information cannot be placed in /etc/krb5.conf.d/. Thus, we need to continue using /var/lib/sss/pubconf/krb5.include.d.

Some of the configuration setting created by SSSD can be converted into static files in /etc/krb5.conf.d. For example, /var/lib/sss/pubconf/krb5.inclulde.d/localauth_plugin can be moved to /etc/krb5.conf.d, as well as /var/lib/sss/pubconf/krb5.inclulde.d/krb5_libdefaults.

However, /var/lib/sss/pubconf/krb5.inclulde.d/domain_realm_<realm_name> cannot be moved to /etc/krb5.conf.d.

Should't we move away from CA Paths on clients by using referrals on the KDC ?

I think there is still something missing on KDC side to allow us doing it fully without capaths in the configuration. That is, we do have support for issuing referrals based on the information about trusted domains in IPA KDB driver but we also rely on SSSD providing capaths configuration on KDC in /var/lib/sss/pubconf/krb5.include.d/

Metadata Update from @stlaz:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.