Whamcloud - gitweb
LU-18005 gss: allow regular users to authenticate on MGS 40/55640/5
authorSebastien Buisson <sbuisson@ddn.com>
Fri, 5 Jul 2024 14:51:44 +0000 (16:51 +0200)
committerOleg Drokin <green@whamcloud.com>
Wed, 31 Jul 2024 16:03:20 +0000 (16:03 +0000)
commit02a3973af6ea048f5f697400a3fc3740520acd36
treefc1c747979ec7cd4b36ab2ba7b23e421aaaa64bc
parentaea9738642fc31b05c405f22fef7234f78f31d8e
LU-18005 gss: allow regular users to authenticate on MGS

It can be useful for regular users to be able to authenticate against
the MGS, for instance to run 'lfs check mgts'.
Just allow this type of authentication request in the code, and take
into account the MGC export when doing 'lfs flushctx', so that any
user key associated with the MGS gets flushed as well.

Add sanity-krb5 test_152 to exercise this capability.

Test-Parameters: trivial
Test-Parameters: testgroup=review-dne-selinux-ssk-part-1
Test-Parameters: testgroup=review-dne-selinux-ssk-part-2
Test-Parameters: kerberos=true testlist=sanity-krb5
Signed-off-by: Sebastien Buisson <sbuisson@ddn.com>
Change-Id: I4871b4ed61af918644e11d64ef5750a858713323
Reviewed-on: https://review.whamcloud.com/c/fs/lustre-release/+/55640
Tested-by: jenkins <devops@whamcloud.com>
Tested-by: Maloo <maloo@whamcloud.com>
Reviewed-by: Aurelien Degremont <adegremont@nvidia.com>
Reviewed-by: Andreas Dilger <adilger@whamcloud.com>
Reviewed-by: Oleg Drokin <green@whamcloud.com>
lustre/llite/llite_lib.c
lustre/mgc/mgc_request.c
lustre/ptlrpc/gss/gss_svc_upcall.c
lustre/ptlrpc/gss/sec_gss.c
lustre/ptlrpc/sec.c
lustre/tests/sanity-krb5.sh
lustre/utils/gss/svcgssd_proc.c