[autobackport: sssd-2-9] man: add details about 'an2ln'#8434
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the man page for sssd_krb5_localauth_plugin to document that the an2ln module is now disabled in the generated Kerberos configuration snippet. While documenting this change is important, the added text contains a couple of statements that are either ambiguous or appear to be incorrect, which could lead to confusion. I've added two review comments with high and critical severity to address these points and suggest improvements for clarity and accuracy.
| <para> | ||
| Note: If using <quote>auth_provider = krb5</quote> then | ||
| <command>sssd_krb5_localauth_plugin</command> is not used, therefore | ||
| the above text is not applicable. | ||
| </para> |
There was a problem hiding this comment.
This statement appears to be incorrect. The sssd_krb5_localauth_plugin is a libkrb5 plugin that is most useful when a Kerberos-based authentication provider (krb5, ad, ipa) is configured in SSSD. The ad and ipa providers are specializations that use the krb5 provider's functionality. Stating that the plugin is not used with auth_provider = krb5 is misleading and could cause significant confusion. This paragraph should be removed or corrected.
| This configuration snippet also disables the | ||
| <command>an2ln</command> module provided by MIT Kerberos if SSSD is | ||
| configured to use the AD or IPA provider. In those environments | ||
| <command>sssd_krb5_localauth_plugin</command> can reliably map the | ||
| system user names to Kerberos principals. A fallback to | ||
| <command>an2ln</command> might cause issues in environments where | ||
| users have the privilege to create Kerberos principals on their own | ||
| which might collide with names of other users used in the system. | ||
| Other modules provided by MIT Kerberos, e.g. | ||
| <command>k5login</command> are not affected. | ||
| </para> |
There was a problem hiding this comment.
The phrasing "if SSSD is configured to use the AD or IPA provider" is ambiguous. It suggests that an2ln is only disabled for AD and IPA providers. If this is a general change to the generated configuration snippet, this sentence should be rephrased to avoid suggesting it's conditional. For example: "This configuration snippet also disables the <command>an2ln</command> module provided by MIT Kerberos. This is particularly beneficial in environments using the AD or IPA provider because..."
|
/packit build |
1 similar comment
|
/packit build |
With a recent security fix the 'an2ln' module was disabled in SSSD's configuration snippet for the localauth configuration of libkrb5. With this patch the related man page is update accordingly. Reviewed-by: Alexey Tikhonov <[email protected]> Reviewed-by: Justin Stephenson <[email protected]> (cherry picked from commit bcd9998)
|
The pull request was accepted by @alexey-tikhonov with the following PR CI status: 🟢 CodeQL (success) There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging. |
434e738 to
5c88469
Compare
4 participants
This is an automatic backport of PR#8396 man: add details about 'an2ln' to branch sssd-2-9, created by @sumit-bose.
Please make sure this backport is correct.
Note
The commits were cherry-picked without conflicts.
You can push changes to this pull request
Original commits
bcd9998 - man: add details about 'an2ln'
Backported commits
Original Pull Request Body
With a recent security fix the 'an2ln' module was disabled in SSSD's configuration snippet for the localauth configuration of libkrb5. With this patch the related man page is update accordingly.