sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-11 05:18:09 +03:00
Code
460e280d3a
samba-mirror/docs-xml/smbdotconf/winbind/createkrb5conf.xml

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

24 lines
814 B
XML
Raw Normal View History

Add a parameter to disable the automatic creation of krb5.conf files This is necessary because MIT 1.5 can't deal with certain types (Tree Root) of transitive AD trusts. The workaround is to add a [capaths] directive to /etc/krb5.conf, which we don't automatically put into the krb5.conf winbind creates. The alternative would have been something like a "krb5 conf include", but I think if someone has to mess with /etc/krb5.conf at this level, it should be easy to add the site-local KDCs as well. Next alternative is to correctly figure out the [capaths] parameter for all trusted domains, but for that I don't have the time right now. Sorry :-)
2009-08-26 16:56:41 +04:00
<samba:parameter name="create krb5 conf"
docs:smbdotconf: make formatting of headers uniform. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2015-05-01 00:32:45 +03:00
context="G"
type="boolean"
Add a parameter to disable the automatic creation of krb5.conf files This is necessary because MIT 1.5 can't deal with certain types (Tree Root) of transitive AD trusts. The workaround is to add a [capaths] directive to /etc/krb5.conf, which we don't automatically put into the krb5.conf winbind creates. The alternative would have been something like a "krb5 conf include", but I think if someone has to mess with /etc/krb5.conf at this level, it should be easy to add the site-local KDCs as well. Next alternative is to correctly figure out the [capaths] parameter for all trusted domains, but for that I don't have the time right now. Sorry :-)
2009-08-26 16:56:41 +04:00
xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
<description>
<para>
s3/doc: some spelling fixes Thanks to Frans Luteijn <f.a.g.luteijn at knoware.nl> for providing the fixes! Autobuild-User(master): Björn Jacke <bj@sernet.de> Autobuild-Date(master): Mon Jun 11 23:16:26 CEST 2012 on sn-devel-104
2012-06-11 22:58:11 +04:00
Setting this parameter to <value type="example">no</value> prevents
Add a parameter to disable the automatic creation of krb5.conf files This is necessary because MIT 1.5 can't deal with certain types (Tree Root) of transitive AD trusts. The workaround is to add a [capaths] directive to /etc/krb5.conf, which we don't automatically put into the krb5.conf winbind creates. The alternative would have been something like a "krb5 conf include", but I think if someone has to mess with /etc/krb5.conf at this level, it should be easy to add the site-local KDCs as well. Next alternative is to correctly figure out the [capaths] parameter for all trusted domains, but for that I don't have the time right now. Sorry :-)
2009-08-26 16:56:41 +04:00
winbind from creating custom krb5.conf files. Winbind normally does
this because the krb5 libraries are not AD-site-aware and thus would
pick any domain controller out of potentially very many. Winbind
is site-aware and makes the krb5 libraries use a local DC by
creating its own krb5.conf files.
</para>
<para>
Preventing winbind from doing this might become necessary if you
have to add special options into your system-krb5.conf that winbind
does not see.
</para>
</description>
<value type="default">yes</value>
</samba:parameter>
Copy Permalink