Whamcloud - gitweb
LU-17023 krb: use a Kerberos realm different from default 14/51914/9
authorSebastien Buisson <sbuisson@ddn.com>
Thu, 10 Aug 2023 11:05:52 +0000 (13:05 +0200)
committerSebastien Buisson <sbuisson@ddn.com>
Mon, 28 Aug 2023 04:41:03 +0000 (06:41 +0200)
commit7865105966ce9b302504afaa2b1f95b5c2ef48c4
tree5cf1f57242ea8983144a94cb8e8127b5f6756226
parent8e8dc1b7e715f46b234ae0b018e2ccb464658df4
LU-17023 krb: use a Kerberos realm different from default

It makes sense to give the ability to specify a Kerberos realm that is
different from the default realm as returned by
krb5_get_default_realm().

On client side, the desired realm needs to be specified via the new
'-R' option to lgss_keyring. This can be specified in the config file
/etc/request-key.d/lgssc.conf to replace the default domain, e.g.:
create lgssc * * /usr/sbin/lgss_keyring -R DOMAIN.COM %o %k %t %d %c %u %g %T %P %S

On server side, the desired realm can be specified via the new '-R'
parameter of the lsvcgssd daemon, replacing the default realm.

This patch adds sanity-krb5 test_1b to exercise the new realm options,
by just re-using the same realm as the test system is configured to
use. And former test_1 is renamed test_1a.

Test-Parameters: kerberos=true testlist=sanity-krb5
Signed-off-by: Sebastien Buisson <sbuisson@ddn.com>
Change-Id: I9c91d5cb9904781d546e77b1e46115fed433618f
13 files changed:
lustre/tests/sanity-krb5.sh
lustre/tests/test-framework.sh
lustre/utils/gss/Makefile.am
lustre/utils/gss/gss_util.c
lustre/utils/gss/gss_util.h
lustre/utils/gss/lgss_keyring.c
lustre/utils/gss/lgss_krb5_utils.c
lustre/utils/gss/lgss_krb5_utils.h
lustre/utils/gss/lgss_utils.c
lustre/utils/gss/lgss_utils.h
lustre/utils/gss/lsupport.c
lustre/utils/gss/lsupport.h
lustre/utils/gss/svcgssd.c