Re: Freeze exception for sssd?

[Petter Reinholdtsen <pere@hungry.com>]

[Russ Allbery]
> That's frustrating, but the current code is going to break for a
> bunch of other people and is also going directly against the
> intended purpose for the SRV records.

If the new autodetection do not work, the sites will be no worse off
than before, where the the old static default configuration had to be
manually replaced after installation.

So the new version make the package better for some sites, and leave
the others in the same situation as they used to be in - having to
replace the config with their sites settings after installation.

This new version will work out of the box for more sites than before,
which was zero, but I know it will not work out of the box for all
sites, and accept that as it work for the sites I am involved in. :)

I would love to get it working for more sites, but suspect that will
have to wait for squeeze+1. :(

> It's not uncommon for specific hostnames to be grabbed by some other
> department or project for legacy reasons, and one of the primary
> purposes of SRV records is to be the canonical source of data so
> that people don't do the wrong thing with hostname guessing.

Did you test it at your site?  Did it work or fail for you?

> Maybe maintain a blacklist of specific sites that cannot use SRV
> records for whatever reason?

Not too keen on hardcoding site lists in the package, but am willing
to find ways to make the autodetection work better.  Please submit a
BTS report if it fail for you, and lets see if we can work out ways to
get the autodetection work also for you. :)

> Incidentally, if /etc/krb5.conf exists, you probably want to look
> there for the Kerberos realm and KDCs, since that file overrides DNS
> for all Kerberos code and is most likely to be correct if it is
> present and contains the information you want.

Yes, I agree, but I ran out of time for such adjustment of the
autodetection.  Sound good, but perhaps for the next release.  It
could also look in /etc/ldap/ldap.conf for the LDAP settings. :)

Happy hacking,
-- 
Petter Reinholdtsen