gssproxy

#41 Define interaction with libnfsidmap for princ -> creds operations
Closed: Fixed Opened by simo.

Closed: Fixed
Reopen Issue

Currently rpc.svcgssd uses libnfsidmap to handle principal -> id mappings.
libnfsidmap is not really convenient to use as it does not integrate with sssd, and although it can use nsswitch it has no way to properly map principals from trusted Realms.

Gss-Proxy will start using getpwnam() and friends directly and libnfsidmap support will be considered for a future addition if there is user demand.

Gss-proxy will currently truncate the REALM portion for the 'local' realm, defined as the default realm in krb5.conf, and will ask nsswitch directly with the whole principal name for non-local principals.
It is expected that something like SSSD will be able to properly resolve users for trusted realms in that case, using the fully qualified principal name directly.

libnfsidmap may be later modified to use the same method for consistency.

Turns out I had forgotten that gssapi has an extension called gss_localname() which can resolve a principal into a localname.
When KRB5 mech is used this function ends up calling krb5_aname_to_localname() which should be plugged into SSSD going forward.

So gss-proxy will use gss_localname() for now and will leave proper name resolution to the gssapi/libkrb5->sssd integration.

This has been done in my tree and will be pushed to master asap.

Metadata Update from @simo:
- Issue assigned to simo
- Issue set to the milestone: 2012 March

Commit 2edbe4fc fixes this issue

Commit c6529386 fixes this issue
Metadata
None
None
None
Normal
task
gssproxy daemon
steved
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.