does not support MIT krb5 1.20

[tjaalton]

the pac responder isn't built:

checking for supported MIT krb5 version... no
configure: WARNING: Cannot build authdata plugin with this version of
MIT Kerberos, please use 1.9.x or later

[tjaalton]

modifying pac_responder.m4 to recognize 1.20 at least allows it to build fine, but I have no way to test if it works

[sumit-bose]

Hi,

thanks for the reminder, I'll check the MIT Kerberos 1.20 code to see if there are any changes. The reason for the check is that we use an API which isn't public yet.

bye,
Sumit

[alexey-tikhonov]

@jrisc, when do you plan to bring 1.20 to Fedora?

[jrisc]

I am not releasing it for now because some changes in the KDB driver are breaking FreeIPA build. We are working to fix that before the branching for Fedora 38.

Here is a Copr repo with 1.20 builds for Fedora:
https://copr.fedorainfracloud.org/coprs/jrische/krb5-1.20/

[sumit-bose]

Hi,

there is a small change to authdata_plugin.h in krb5/krb5@789a4d3 from @pbrezina.

Effectively we already use a const here but currently trick the compiler to ignore it by setting name as

((void *)((uintptr_t)("sssd_sssdpac")))

in src/sss_client/sssd_pac.c. So it would be possible to ignore this change and just allow 1.20 in pac_responder.m4.

As an alternative we can additionally include the change and remove the casting magic. Since we use our own header file and the MIT Kerberos code treated the name as const in older versions I think there are no issues with older version of MIT Kerberos.

I tend to the latter, any comments?

bye,
Sumit

[pbrezina]

The latter sounds fine.

[pbrezina]

Pushed PR: #6312

• master
  • abd8966 - BUILD: Accept krb5 1.20 for building the PAC plugin