client install: do not assume /etc/krb5.conf.d exists #623
Conversation
|
I'd rather create |
|
There is no reason to, the directory is not owned by us and we don't use it for anything anyway (see ticket triage for relevant discussion). |
|
Would you be upgrading the krb5.conf after people upgrade krb5-libs to include the new includedir then? I've had to help a lot of people that ended up with configuration files lacking krb5.conf.d due to ipa-client setups (and other company configs, but at least that's limited to people working at companies giving broken krb5 configs). |
ipaclient/install/client.py
Outdated
| ] | ||
|
|
||
| if os.path.exists(paths.COMMON_KRB5_CONF_DIR): | ||
| opts += [ |
There was a problem hiding this comment.
Why using opts += here, while the rest of the code uses opts.extend?
There was a problem hiding this comment.
Because I didn't notice that.
|
@puiterwijk, upgrade will be handled by krb5 itself, see https://bugzilla.redhat.com/show_bug.cgi?id=1431198. |
|
FYI: debian testing has MIT kerberos 1.15 and So +1 for @HonzaCholasta approach. |
|
The ipa-certauth plugin now starts to rely on the existence of Practicality beats purity, let's make |
|
On (28/03/17 04:08), Christian Heimes wrote:
The ipa-certauth plugin now starts to rely on the existence of ```/etc/krb5.conf.d```:
```
%config(noreplace) %{_sysconfdir}/krb5.conf.d/ipa-certauth
```
The upstream spec file is fedora/rhel spec files and fedora+rhel have
`%{_sysconfdir}/krb5.conf.d/`. I cannot see any problem.
**Practicality beats purity**, let's make ```/etc/krb5.conf.d``` part of the offical FreeIPA configuation settings on all IPA enrolled systems.
But neither debian nor arch linux/opensuse have this directory(or any other)
included by default in `/etc/krb5.conf`.
I would like to see standard directory for krb5 snippet files.
But that should be solved in distribution. And just used by freeipa.
LS
|
|
Practicality beats purity Let's define
|
|
(Note: a standard directory in distributions that freeipa could use would be provided by the krb5 maintainer, not the freeipa maintainer.) |
Add `includedir /etc/krb5.conf.d` to /etc/krb5.conf only if /etc/krb5.conf.d exists. Do not rely on /etc/krb5.conf.d to enable the certauth plugin. This fixes install on platforms which do not have /etc/krb5.conf.d. https://pagure.io/freeipa/issue/6589
|
Adding on to my previous comment: I've talked with the Debian maintainers, and they plan to add the same |
|
@frozencemetery, this is not for the sake of Debian. We will still have to worry about this for operating systems which are not Fedora- or Debian-based. |
martbab
added
ack
|
master:
|
Add
includedir /etc/krb5.conf.dto /etc/krb5.conf only if/etc/krb5.conf.d exists.
This fixes client install on platforms which do not have /etc/krb5.conf.d.
https://pagure.io/freeipa/issue/6589