Bug 46380 – univention-domain-join should adjust settings to enable saml-kerberos

Bug 46380 - univention-domain-join should adjust settings to enable saml-kerberos


Summary:	univention-domain-join should adjust settings to enable saml-kerberos

Status:	RESOLVED DUPLICATE of bug 48379

Product:	UCS
Classification:	Unclassified
Component:	Univention Domain Join (Ubuntu)
Version:	UCS 4.3
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	---
Assigned To:	Richard Ulmer
QA Contact:	UCS maintainers

URL:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2018-02-23 12:16 CET by Erik Damrose
Modified:	2019-01-09 18:51 CET (History)
CC List:	1 user (show)

See Also:
What kind of report is it?:	Feature Request
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Erik Damrose

2018-02-23 12:16:17 CET

Single Sign-on via kerberos is a new feature in UCS 4.3 (Bug #33214). It would be great if the domain-join assistant would configure the system to enable the feature while joining the UCS domain.

- Add 'rdns = false' to the libdefaults section in /etc/krb5.conf
- Install the UCS root ca systemwide (Bug #46379)
- (Optional) configure known browsers to enable negotiate against ucs domain

Comment 1 Richard Ulmer

2018-03-20 10:39:50 CET

Since Bug #46379 is fixed, the UCS root ca is now available system-wide.

All of the supported Ubuntu versions (Ubuntu 14.04, 16.04 and 17.10) use the Heimdal implementation of Kerberos, which doesn't need the 'rdns = false' setting in /etc/krb5.conf, so I didn't add this to the configuration.

Since configuring browsers to enable negotiate against UCS domain is non tivial and also documented I left this feature out.

Under these circumstances no changes needed to be made to the code.

Comment 2 Arvid Requate

2019-01-09 18:51:01 CET


*** This bug has been marked as a duplicate of bug 48379 ***