diff options
| author | Stefan Metzmacher <metze@samba.org> | 2019-09-11 16:44:43 +0200 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2019-09-25 23:37:34 +0000 |
| commit | 4760bbaae22aede59869577cf6176f10d816ade7 (patch) | |
| tree | 93d2eea8ed2571f4599bcde8132c812a1bcf2ace | |
| parent | aa1e8e535519163d03edde2a9e34269c3ce576b4 (diff) | |
| download | samba-4760bbaae22aede59869577cf6176f10d816ade7.tar.gz | |
docs-xml: add "winbind use krb5 enterprise principals" option
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14124
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
(cherry picked from commit 9520652399696010c333a3ce7247809ce5337a91)
| -rw-r--r-- | docs-xml/smbdotconf/winbind/winbindusekrb5enterpriseprincipals.xml | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/docs-xml/smbdotconf/winbind/winbindusekrb5enterpriseprincipals.xml b/docs-xml/smbdotconf/winbind/winbindusekrb5enterpriseprincipals.xml new file mode 100644 index 00000000000..bfc11c8636c --- /dev/null +++ b/docs-xml/smbdotconf/winbind/winbindusekrb5enterpriseprincipals.xml @@ -0,0 +1,34 @@ +<samba:parameter name="winbind use krb5 enterprise principals" + context="G" + type="boolean" + xmlns:samba="http://www.samba.org/samba/DTD/samba-doc"> +<description> + <para>winbindd is able to get kerberos tickets for + pam_winbind with krb5_auth or wbinfo -K/--krb5auth=. + </para> + + <para>winbindd (at least on a domain member) is never be able + to have a complete picture of the trust topology (which is managed by the DCs). + There might be uPNSuffixes and msDS-SPNSuffixes values, + which don't belong to any AD domain at all. + </para> + + <para>With <smbconfoption name="winbind scan trusted domains">no</smbconfoption> + winbindd don't even get an incomplete picture of the topology. + </para> + + <para>It is not really required to know about the trust topology. + We can just rely on the [K]DCs of our primary domain (e.g. PRIMARY.A.EXAMPLE.COM) + and use enterprise principals e.g. upnfromB@B.EXAMPLE.COM@PRIMARY.A.EXAMPLE.COM + and follow the WRONG_REALM referrals in order to find the correct DC. + The final principal might be userfromB@INTERNALB.EXAMPLE.PRIVATE. + </para> + + <para>With <smbconfoption name="winbind use krb5 enterprise principals">yes</smbconfoption> + winbindd enterprise principals will be used. + </para> +</description> + +<value type="default">no</value> +<value type="example">yes</value> +</samba:parameter> |