From Fedora Project Wiki
< Features
(Created page with "<!-- All fields on this form are required to be accepted by FESCo. We also request that you maintain the same order of sections so that all of the feature pages are uniform. --...") |
|||
| (13 intermediate revisions by 4 users not shown) | |||
| Line 4: | Line 4: | ||
<!-- The actual name of your feature page should look something like: Features/YourFeatureName. This keeps all features in the same namespace --> | <!-- The actual name of your feature page should look something like: Features/YourFeatureName. This keeps all features in the same namespace --> | ||
= | = KRB5 DIR: Credential Caches = | ||
KRB5 DIR: Credential Caches | |||
== Summary == | == Summary == | ||
<!-- A sentence or two summarizing what this feature is and what it will do. This information is used for the overall feature summary page for each release. --> | <!-- A sentence or two summarizing what this feature is and what it will do. This information is used for the overall feature summary page for each release. --> | ||
Kerberos 1.10 added a new cache storage type, DIR: which allows Kerberos to maintain TGTs for multiple KDCs simultaneously and auto-select between them when negotiating with Kerberized resources. Fedora should switch to using the DIR: cache format over the older FILE: cache format to support accessing | Kerberos 1.10 added a new cache storage type, DIR: which allows Kerberos to maintain TGTs for multiple KDCs simultaneously and auto-select between them when negotiating with Kerberized resources. Fedora should switch to using the DIR: cache format over the older FILE: cache format to support accessing multiple Kerberos realms. | ||
== Owner == | == Owner == | ||
| Line 21: | Line 19: | ||
== Current status == | == Current status == | ||
* Targeted release: [[Releases/18 | Fedora 18 ]] | * Targeted release: [[Releases/18 | Fedora 18 ]] | ||
* Last updated: [[User:Sgallagh|Sgallagh]] | * Last updated: [[User:Sgallagh|Sgallagh]] 15:49, 07 August 2012 (UTC) | ||
* Percentage of completion: | * Percentage of completion: 100% | ||
<!-- CHANGE THE "FedoraVersion" TEMPLATES ABOVE TO PLAIN NUMBERS WHEN YOU COMPLETE YOUR PAGE. --> | <!-- CHANGE THE "FedoraVersion" TEMPLATES ABOVE TO PLAIN NUMBERS WHEN YOU COMPLETE YOUR PAGE. --> | ||
| Line 30: | Line 28: | ||
Support of multiple Kerberos realms is a critical feature and has been one of the most-requested enhancements of Kerberos. Having the ability to acquire a single-sign-on credential for other realms without traditional hurdles will allow users to set up environments such as: | Support of multiple Kerberos realms is a critical feature and has been one of the most-requested enhancements of Kerberos. Having the ability to acquire a single-sign-on credential for other realms without traditional hurdles will allow users to set up environments such as: | ||
1) Log on to their local machine using their corporate Kerberos environment, acquiring that TGT | 1) Log on to their local machine using their corporate Kerberos environment, acquiring that TGT. | ||
2) Present credentials and acquire a ticket for their partner's environment and be able to access resources in both without additional steps. | 2) Present credentials and acquire a ticket for their partner's environment and be able to access resources in both without additional steps. | ||
In conjunction with [[Features/KRB5CacheMove]], this directory containing credential caches will be located at /run/user/$UID/krb5cc. A per-session credential cache should be able to be matched by globbing for /run/user/$UID/krb5cc*. | |||
== Benefit to Fedora == | == Benefit to Fedora == | ||
| Line 37: | Line 37: | ||
The basics are described in the Detailed Description section. Other potential benefits would be that it would make it simpler to eventually migrate the Fedora development infrastructure to use Kerberos. One of the major hurdles to this effort has always been that it would be difficult for users who already sign in to Kerberos environments to also work in Fedora. With this capability added, that's one fewer roadblock to this conversion. | The basics are described in the Detailed Description section. Other potential benefits would be that it would make it simpler to eventually migrate the Fedora development infrastructure to use Kerberos. One of the major hurdles to this effort has always been that it would be difficult for users who already sign in to Kerberos environments to also work in Fedora. With this capability added, that's one fewer roadblock to this conversion. | ||
Users will be able to set up NFSv4 mounts to file servers in multiple Kerberos realms. | |||
== Scope == | == Scope == | ||
| Line 45: | Line 47: | ||
* krb5: Will need to change the default configuration to specify DIR: caches instead of FILE: caches | * krb5: Will need to change the default configuration to specify DIR: caches instead of FILE: caches | ||
* SSSD: Will need to add support for the DIR: caches internally. See https://fedorahosted.org/sssd/ticket/974 | * SSSD: Will need to add support for the DIR: caches internally. See https://fedorahosted.org/sssd/ticket/974 | ||
* [https://bugzilla.redhat.com/show_bug.cgi?id=833026 pam_krb5]: Will need to be able to create DIR: caches during login | |||
* [https://bugzilla.redhat.com/show_bug.cgi?id=833024 gssd (nfs-utils)]: Will need to be updated to understand the DIR: cache structure (work will overlap 90% with [[Features/KRB5CacheMove]]) | |||
* GNOME (optional): Can be updated to support additional Kerberos realms as "Online Accounts" (similar to the Google Accounts currently supported) | |||
* krb5-auth-dialog: Will need to have DIR: cache support added. GNOME project may be absorbing this functionality | |||
== How To Test == | == How To Test == | ||
| Line 60: | Line 66: | ||
3. What are the expected results of those actions? | 3. What are the expected results of those actions? | ||
--> | --> | ||
Some testing will be easily handled by the use of the 'klist' and 'kinit' command-line functions. We will also want to test GSSD/NFSv4 setups using multiple realms. | |||
== User Experience == | == User Experience == | ||
<!-- If this feature is noticeable by its target audience, how will their experiences change as a result? Describe what they will see or notice. --> | <!-- If this feature is noticeable by its target audience, how will their experiences change as a result? Describe what they will see or notice. --> | ||
Users will be able to log into multiple Kerberos realms simultaneously. If the GNOME features are also added in time, they will have a graphical interface for credential acquisition. | |||
== Dependencies == | == Dependencies == | ||
<!-- What other packages (RPMs) depend on this package? Are there changes outside the developers' control on which completion of this feature depends? In other words, completion of another feature owned by someone else and might cause you to not be able to finish on time or that you would need to coordinate? Other upstream projects like the kernel (if this is not a kernel feature)? --> | <!-- What other packages (RPMs) depend on this package? Are there changes outside the developers' control on which completion of this feature depends? In other words, completion of another feature owned by someone else and might cause you to not be able to finish on time or that you would need to coordinate? Other upstream projects like the kernel (if this is not a kernel feature)? --> | ||
* [[Features/KRB5CacheMove]] - This is not a strict dependency, but they are closely interconnected. | * [[Features/KRB5CacheMove]] - This is not a strict dependency, but they are closely interconnected. | ||
* krb5 | |||
* sssd | |||
* pam_krb5 | |||
* sshd | |||
* nfs-utils | |||
* cifs-utils | |||
* gnome-* | |||
== Contingency Plan == | == Contingency Plan == | ||
<!-- If you cannot complete your feature by the final development freeze, what is the backup plan? This might be as simple as "None necessary, revert to previous release behaviour." Or it might not. If you feature is not completed in time we want to assure others that other parts of Fedora will not be in jeopardy. --> | <!-- If you cannot complete your feature by the final development freeze, what is the backup plan? This might be as simple as "None necessary, revert to previous release behaviour." Or it might not. If you feature is not completed in time we want to assure others that other parts of Fedora will not be in jeopardy. --> | ||
Kerberos still retains support for the current FILE: caches. We can revert the default configurations back to using that and everything should work fine. | |||
== Documentation == | == Documentation == | ||
<!-- Is there upstream documentation on this feature, or notes you have written yourself? Link to that material here so other interested developers can get involved. --> | <!-- Is there upstream documentation on this feature, or notes you have written yourself? Link to that material here so other interested developers can get involved. --> | ||
* http://k5wiki.kerberos.org/wiki/Projects/Client_principal_selection | * http://k5wiki.kerberos.org/wiki/Projects/Client_principal_selection | ||
* https://fedorahosted.org/sssd/ticket/974 | |||
== Release Notes == | == Release Notes == | ||
<!-- The Fedora Release Notes inform end-users about what is new in the release. Examples of past release notes are here: http://docs.fedoraproject.org/release-notes/ --> | <!-- The Fedora Release Notes inform end-users about what is new in the release. Examples of past release notes are here: http://docs.fedoraproject.org/release-notes/ --> | ||
<!-- The release notes also help users know how to deal with platform changes such as ABIs/APIs, configuration or data file formats, or upgrade concerns. If there are any such changes involved in this feature, indicate them here. You can also link to upstream documentation if it satisfies this need. This information forms the basis of the release notes edited by the documentation team and shipped with the release. --> | <!-- The release notes also help users know how to deal with platform changes such as ABIs/APIs, configuration or data file formats, or upgrade concerns. If there are any such changes involved in this feature, indicate them here. You can also link to upstream documentation if it satisfies this need. This information forms the basis of the release notes edited by the documentation team and shipped with the release. --> | ||
* | * Fedora's Kerberos support will now allow users to maintain credentials for multiple identities and for the GSSAPI client code to automatically select credentials based on the target service and hostname. | ||
== Comments and Discussion == | == Comments and Discussion == | ||
| Line 84: | Line 104: | ||
[[Category: | [[Category:FeatureAcceptedF18]] | ||
<!-- When your feature page is completed and ready for review --> | <!-- When your feature page is completed and ready for review --> | ||
<!-- remove Category:FeaturePageIncomplete and change it to Category:FeatureReadyForWrangler --> | <!-- remove Category:FeaturePageIncomplete and change it to Category:FeatureReadyForWrangler --> | ||
<!-- After review, the feature wrangler will move your page to Category:FeatureReadyForFesco... if it still needs more work it will move back to Category:FeaturePageIncomplete--> | <!-- After review, the feature wrangler will move your page to Category:FeatureReadyForFesco... if it still needs more work it will move back to Category:FeaturePageIncomplete--> | ||
<!-- A pretty picture of the page category usage is at: https://fedoraproject.org/wiki/Features/Policy/Process --> | <!-- A pretty picture of the page category usage is at: https://fedoraproject.org/wiki/Features/Policy/Process --> | ||
Latest revision as of 18:19, 26 September 2012
KRB5 DIR: Credential Caches
Summary
Kerberos 1.10 added a new cache storage type, DIR: which allows Kerberos to maintain TGTs for multiple KDCs simultaneously and auto-select between them when negotiating with Kerberized resources. Fedora should switch to using the DIR: cache format over the older FILE: cache format to support accessing multiple Kerberos realms.
Owner
- Name: Stephen Gallagher
- Email: sgallagh@redhat.com
Current status
- Targeted release: Fedora 18
- Last updated: Sgallagh 15:49, 07 August 2012 (UTC)
- Percentage of completion: 100%
Detailed Description
Support of multiple Kerberos realms is a critical feature and has been one of the most-requested enhancements of Kerberos. Having the ability to acquire a single-sign-on credential for other realms without traditional hurdles will allow users to set up environments such as: 1) Log on to their local machine using their corporate Kerberos environment, acquiring that TGT. 2) Present credentials and acquire a ticket for their partner's environment and be able to access resources in both without additional steps.
In conjunction with Features/KRB5CacheMove, this directory containing credential caches will be located at /run/user/$UID/krb5cc. A per-session credential cache should be able to be matched by globbing for /run/user/$UID/krb5cc*.
Benefit to Fedora
The basics are described in the Detailed Description section. Other potential benefits would be that it would make it simpler to eventually migrate the Fedora development infrastructure to use Kerberos. One of the major hurdles to this effort has always been that it would be difficult for users who already sign in to Kerberos environments to also work in Fedora. With this capability added, that's one fewer roadblock to this conversion.
Users will be able to set up NFSv4 mounts to file servers in multiple Kerberos realms.
Scope
Multiple packages will need to be updated to support this, though the changes to those packages in many cases will be limited. The necessary functionality is already available in the kerberos libraries provided by the 'krb5' package.
- krb5: Will need to change the default configuration to specify DIR: caches instead of FILE: caches
- SSSD: Will need to add support for the DIR: caches internally. See https://fedorahosted.org/sssd/ticket/974
- pam_krb5: Will need to be able to create DIR: caches during login
- gssd (nfs-utils): Will need to be updated to understand the DIR: cache structure (work will overlap 90% with Features/KRB5CacheMove)
- GNOME (optional): Can be updated to support additional Kerberos realms as "Online Accounts" (similar to the Google Accounts currently supported)
- krb5-auth-dialog: Will need to have DIR: cache support added. GNOME project may be absorbing this functionality
How To Test
Some testing will be easily handled by the use of the 'klist' and 'kinit' command-line functions. We will also want to test GSSD/NFSv4 setups using multiple realms.
User Experience
Users will be able to log into multiple Kerberos realms simultaneously. If the GNOME features are also added in time, they will have a graphical interface for credential acquisition.
Dependencies
- Features/KRB5CacheMove - This is not a strict dependency, but they are closely interconnected.
- krb5
- sssd
- pam_krb5
- sshd
- nfs-utils
- cifs-utils
- gnome-*
Contingency Plan
Kerberos still retains support for the current FILE: caches. We can revert the default configurations back to using that and everything should work fine.
Documentation
- http://k5wiki.kerberos.org/wiki/Projects/Client_principal_selection
- https://fedorahosted.org/sssd/ticket/974
Release Notes
- Fedora's Kerberos support will now allow users to maintain credentials for multiple identities and for the GSSAPI client code to automatically select credentials based on the target service and hostname.