Whamcloud - gitweb
LU-17023 krb: use a Kerberos realm different from default
authorSebastien Buisson <sbuisson@ddn.com>
Thu, 10 Aug 2023 11:05:52 +0000 (13:05 +0200)
committerAndreas Dilger <adilger@whamcloud.com>
Fri, 1 Sep 2023 13:19:36 +0000 (13:19 +0000)
commit59281bf7c1b4961a73942d1a4dfd798db0a2258f
tree4e25889996d3b934a07a8674f417d56114a9a3a2
parentcff404e9546474bb4c92094478c4e0e3ce4fb78f
LU-17023 krb: use a Kerberos realm different from default

It makes sense to give the ability to specify a Kerberos realm that is
different from the default realm as returned by
krb5_get_default_realm().

On client side, the desired realm needs to be specified via the new
'-R' option to lgss_keyring. This can be specified in the config file
/etc/request-key.d/lgssc.conf to replace the default domain, e.g.:
create lgssc * * /usr/sbin/lgss_keyring -R DOMAIN.COM %o %k %t %d %c %u %g %T %P %S

On server side, the desired realm can be specified via the new '-R'
parameter of the lsvcgssd daemon, replacing the default realm.

This patch adds sanity-krb5 test_1b to exercise the new realm options,
by just re-using the same realm as the test system is configured to
use. And former test_1 is renamed test_1a.

Lustre-change: https://review.whamcloud.com/51914
Lustre-commit: TBD (from 7865105966ce9b302504afaa2b1f95b5c2ef48c4)

Test-Parameters: kerberos=true testlist=sanity-krb5
Signed-off-by: Sebastien Buisson <sbuisson@ddn.com>
Change-Id: I9c91d5cb9904781d546e77b1e46115fed433618f
Reviewed-on: https://review.whamcloud.com/c/ex/lustre-release/+/52151
Tested-by: jenkins <devops@whamcloud.com>
Tested-by: Maloo <maloo@whamcloud.com>
Reviewed-by: Andreas Dilger <adilger@whamcloud.com>
13 files changed:
lustre/tests/sanity-krb5.sh
lustre/tests/test-framework.sh
lustre/utils/gss/Makefile.am
lustre/utils/gss/gss_util.c
lustre/utils/gss/gss_util.h
lustre/utils/gss/lgss_keyring.c
lustre/utils/gss/lgss_krb5_utils.c
lustre/utils/gss/lgss_krb5_utils.h
lustre/utils/gss/lgss_utils.c
lustre/utils/gss/lgss_utils.h
lustre/utils/gss/lsupport.c
lustre/utils/gss/lsupport.h
lustre/utils/gss/svcgssd.c