|
 |
ecf709 |
From 14d42e26c2050c1941874e83761fae69585ddc27 Mon Sep 17 00:00:00 2001
|
|
|
ecf709 |
From: Jakub Hrozek <jhrozek@redhat.com>
|
|
|
ecf709 |
Date: Wed, 8 Mar 2017 17:46:09 +0100
|
|
|
ecf709 |
Subject: [PATCH 27/36] MAN: Add a manual page for sssd-kcm
|
|
|
ecf709 |
MIME-Version: 1.0
|
|
|
ecf709 |
Content-Type: text/plain; charset=UTF-8
|
|
|
ecf709 |
Content-Transfer-Encoding: 8bit
|
|
|
ecf709 |
|
|
|
ecf709 |
Reviewed-by: Michal Židek <mzidek@redhat.com>
|
|
|
ecf709 |
Reviewed-by: Simo Sorce <simo@redhat.com>
|
|
|
ecf709 |
---
|
|
|
ecf709 |
contrib/sssd.spec.in | 1 +
|
|
|
ecf709 |
src/man/Makefile.am | 9 ++-
|
|
|
ecf709 |
src/man/po/po4a.cfg | 1 +
|
|
|
ecf709 |
src/man/sssd-kcm.8.xml | 193 +++++++++++++++++++++++++++++++++++++++++++++++++
|
|
|
ecf709 |
4 files changed, 203 insertions(+), 1 deletion(-)
|
|
|
ecf709 |
create mode 100644 src/man/sssd-kcm.8.xml
|
|
|
ecf709 |
|
|
|
ecf709 |
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
|
|
|
ecf709 |
index 52d33b4de281dc1d91a9027ac1c8c878e66fb396..1d4d020415ee28292bb4d88c78de205465d812f1 100644
|
|
|
ecf709 |
--- a/contrib/sssd.spec.in
|
|
|
ecf709 |
+++ b/contrib/sssd.spec.in
|
|
|
ecf709 |
@@ -1206,6 +1206,7 @@ done
|
|
|
ecf709 |
%config(noreplace) %{_sysconfdir}/krb5.conf.d/kcm_default_ccache
|
|
|
ecf709 |
%{_unitdir}/sssd-kcm.socket
|
|
|
ecf709 |
%{_unitdir}/sssd-kcm.service
|
|
|
ecf709 |
+%{_mandir}/man8/sssd-kcm.8*
|
|
|
ecf709 |
%endif
|
|
|
ecf709 |
|
|
|
ecf709 |
%pre common
|
|
|
ecf709 |
diff --git a/src/man/Makefile.am b/src/man/Makefile.am
|
|
|
ecf709 |
index 142d6e2743f814294e3d92c8342070b8230bb3e5..3a063614f085691652db32d76315375466e0d3de 100644
|
|
|
ecf709 |
--- a/src/man/Makefile.am
|
|
|
ecf709 |
+++ b/src/man/Makefile.am
|
|
|
ecf709 |
@@ -27,6 +27,9 @@ endif
|
|
|
ecf709 |
if BUILD_SECRETS
|
|
|
ecf709 |
SEC_CONDS = ;with_secrets
|
|
|
ecf709 |
endif
|
|
|
ecf709 |
+if BUILD_SECRETS
|
|
|
ecf709 |
+KCM_CONDS = ;with_kcm
|
|
|
ecf709 |
+endif
|
|
|
ecf709 |
if GPO_DEFAULT_ENFORCING
|
|
|
ecf709 |
GPO_CONDS = ;gpo_default_enforcing
|
|
|
ecf709 |
else
|
|
|
ecf709 |
@@ -40,7 +43,7 @@ FILES_CONDS = ;enable_files_domain
|
|
|
ecf709 |
else
|
|
|
ecf709 |
FILES_CONDS = ;no_enable_files_domain
|
|
|
ecf709 |
endif
|
|
|
ecf709 |
-CONDS = with_false$(SUDO_CONDS)$(AUTOFS_CONDS)$(SSH_CONDS)$(PAC_RESPONDER_CONDS)$(IFP_CONDS)$(GPO_CONDS)$(SEC_CONDS)$(SYSTEMD_CONDS)$(FILES_CONDS)
|
|
|
ecf709 |
+CONDS = with_false$(SUDO_CONDS)$(AUTOFS_CONDS)$(SSH_CONDS)$(PAC_RESPONDER_CONDS)$(IFP_CONDS)$(GPO_CONDS)$(SEC_CONDS)$(SYSTEMD_CONDS)$(FILES_CONDS)$(KCM_CONDS)
|
|
|
ecf709 |
|
|
|
ecf709 |
|
|
|
ecf709 |
#Special Rules:
|
|
|
ecf709 |
@@ -85,6 +88,10 @@ if BUILD_SECRETS
|
|
|
ecf709 |
man_MANS += sssd-secrets.5
|
|
|
ecf709 |
endif
|
|
|
ecf709 |
|
|
|
ecf709 |
+if BUILD_KCM
|
|
|
ecf709 |
+man_MANS += sssd-kcm.8
|
|
|
ecf709 |
+endif
|
|
|
ecf709 |
+
|
|
|
ecf709 |
if BUILD_NFS_IDMAP
|
|
|
ecf709 |
man_MANS += sss_rpcidmapd.5
|
|
|
ecf709 |
endif
|
|
|
ecf709 |
diff --git a/src/man/po/po4a.cfg b/src/man/po/po4a.cfg
|
|
|
ecf709 |
index d1f6ac39f841c61ae3d2393fb3402dc21b9cbd69..a02f97e777fa76615e4d5cbcfc788956706d8cd0 100644
|
|
|
ecf709 |
--- a/src/man/po/po4a.cfg
|
|
|
ecf709 |
+++ b/src/man/po/po4a.cfg
|
|
|
ecf709 |
@@ -31,6 +31,7 @@
|
|
|
ecf709 |
[type:docbook] sssctl.8.xml $lang:$(builddir)/$lang/sssctl.8.xml
|
|
|
ecf709 |
[type:docbook] sssd-files.5.xml $lang:$(builddir)/$lang/sssd-files.5.xml
|
|
|
ecf709 |
[type:docbook] sssd-secrets.5.xml $lang:$(builddir)/$lang/sssd-secrets.5.xml
|
|
|
ecf709 |
+[type:docbook] sssd-kcm.8.xml $lang:$(builddir)/$lang/sssd-kcm.8.xml
|
|
|
ecf709 |
[type:docbook] include/service_discovery.xml $lang:$(builddir)/$lang/include/service_discovery.xml opt:"-k 0"
|
|
|
ecf709 |
[type:docbook] include/upstream.xml $lang:$(builddir)/$lang/include/upstream.xml opt:"-k 0"
|
|
|
ecf709 |
[type:docbook] include/failover.xml $lang:$(builddir)/$lang/include/failover.xml opt:"-k 0"
|
|
|
ecf709 |
diff --git a/src/man/sssd-kcm.8.xml b/src/man/sssd-kcm.8.xml
|
|
|
ecf709 |
new file mode 100644
|
|
|
ecf709 |
index 0000000000000000000000000000000000000000..5dc93838e48723bdb470c0a9c8575bd17c7593e8
|
|
|
ecf709 |
--- /dev/null
|
|
|
ecf709 |
+++ b/src/man/sssd-kcm.8.xml
|
|
|
ecf709 |
@@ -0,0 +1,193 @@
|
|
|
ecf709 |
+
|
|
|
ecf709 |
+
|
|
|
ecf709 |
+"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
|
|
|
ecf709 |
+<reference>
|
|
|
ecf709 |
+<title>SSSD Manual pages</title>
|
|
|
ecf709 |
+<refentry>
|
|
|
ecf709 |
+ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="include/upstream.xml" />
|
|
|
ecf709 |
+
|
|
|
ecf709 |
+ <refmeta>
|
|
|
ecf709 |
+ <refentrytitle>sssd-kcm</refentrytitle>
|
|
|
ecf709 |
+ <manvolnum>8</manvolnum>
|
|
|
ecf709 |
+ <refmiscinfo class="manual">File Formats and Conventions</refmiscinfo>
|
|
|
ecf709 |
+ </refmeta>
|
|
|
ecf709 |
+
|
|
|
ecf709 |
+ <refnamediv id='name'>
|
|
|
ecf709 |
+ <refname>sssd-kcm</refname>
|
|
|
ecf709 |
+ <refpurpose>SSSD Kerberos Cache Manager</refpurpose>
|
|
|
ecf709 |
+ </refnamediv>
|
|
|
ecf709 |
+
|
|
|
ecf709 |
+ <refsect1 id='description'>
|
|
|
ecf709 |
+ <title>DESCRIPTION</title>
|
|
|
ecf709 |
+ <para>
|
|
|
ecf709 |
+ This manual page describes the configuration of the SSSD Kerberos
|
|
|
ecf709 |
+ Cache Manager (KCM). KCM is a process that stores, tracks and
|
|
|
ecf709 |
+ manages Kerberos credential caches. It originates in the Heimdal
|
|
|
ecf709 |
+ Kerberos project, although the MIT Kerberos library also provides
|
|
|
ecf709 |
+ client side (more details on that below) support for the KCM
|
|
|
ecf709 |
+ credential cache.
|
|
|
ecf709 |
+ </para>
|
|
|
ecf709 |
+ <para>
|
|
|
ecf709 |
+ In a setup where Kerberos caches are managed by KCM, the
|
|
|
ecf709 |
+ Kerberos library (typically used through an application, like
|
|
|
ecf709 |
+ e.g.,
|
|
|
ecf709 |
+ <citerefentry>
|
|
|
ecf709 |
+ <refentrytitle>kinit</refentrytitle><manvolnum>1</manvolnum>
|
|
|
ecf709 |
+ </citerefentry>,
|
|
|
ecf709 |
+ is a <quote>"KCM client"</quote> and the KCM daemon
|
|
|
ecf709 |
+ is being referred to as a <quote>"KCM server"</quote>. The client
|
|
|
ecf709 |
+ and server communicate over a UNIX socket.
|
|
|
ecf709 |
+ </para>
|
|
|
ecf709 |
+ <para>
|
|
|
ecf709 |
+ The KCM server keeps track of each credential caches's owner and
|
|
|
ecf709 |
+ performs access check control based on the UID and GID of the
|
|
|
ecf709 |
+ KCM client. The root user has access to all credential caches.
|
|
|
ecf709 |
+ </para>
|
|
|
ecf709 |
+ <para>
|
|
|
ecf709 |
+ The KCM credential cache has several interesting properties:
|
|
|
ecf709 |
+ <itemizedlist>
|
|
|
ecf709 |
+ <listitem>
|
|
|
ecf709 |
+ <para>
|
|
|
ecf709 |
+ since the process runs in userspace, it is subject to UID namespacing, ulike the kernel keyring
|
|
|
ecf709 |
+ </para>
|
|
|
ecf709 |
+ </listitem>
|
|
|
ecf709 |
+ <listitem>
|
|
|
ecf709 |
+ <para>
|
|
|
ecf709 |
+ unlike the kernel keyring-based cache, which is shared between all containers, the KCM server is a separate process whose entry point is a UNIX socket
|
|
|
ecf709 |
+ </para>
|
|
|
ecf709 |
+ </listitem>
|
|
|
ecf709 |
+ <listitem>
|
|
|
ecf709 |
+ <para>
|
|
|
ecf709 |
+ the SSSD implementation stores the ccaches in the SSSD
|
|
|
ecf709 |
+ <citerefentry>
|
|
|
ecf709 |
+ <refentrytitle>sssd-secrets</refentrytitle><manvolnum>5</manvolnum>
|
|
|
ecf709 |
+ </citerefentry>
|
|
|
ecf709 |
+ secrets store, allowing the ccaches to survive KCM server restarts or machine reboots.
|
|
|
ecf709 |
+ </para>
|
|
|
ecf709 |
+ </listitem>
|
|
|
ecf709 |
+ </itemizedlist>
|
|
|
ecf709 |
+ This allows the system to use a collection-aware credential
|
|
|
ecf709 |
+ cache, yet share the credential cache between some or no
|
|
|
ecf709 |
+ containers by bind-mounting the socket.
|
|
|
ecf709 |
+ </para>
|
|
|
ecf709 |
+ </refsect1>
|
|
|
ecf709 |
+
|
|
|
ecf709 |
+ <refsect1 id='usage'>
|
|
|
ecf709 |
+ <title>USING THE KCM CREDENTIAL CACHE</title>
|
|
|
ecf709 |
+ <para>
|
|
|
ecf709 |
+ In order to use KCM credential cache, it must be selected as the default
|
|
|
ecf709 |
+ credential type in
|
|
|
ecf709 |
+ <citerefentry>
|
|
|
ecf709 |
+ <refentrytitle>krb5.conf</refentrytitle><manvolnum>5</manvolnum>
|
|
|
ecf709 |
+ </citerefentry>,
|
|
|
ecf709 |
+ The credentials cache name must be only <quote>KCM:</quote>
|
|
|
ecf709 |
+ without any template expansions. For example:
|
|
|
ecf709 |
+ <programlisting>
|
|
|
ecf709 |
+[libdefaults]
|
|
|
ecf709 |
+ default_ccache_name = KCM:
|
|
|
ecf709 |
+ </programlisting>
|
|
|
ecf709 |
+ </para>
|
|
|
ecf709 |
+ <para>
|
|
|
ecf709 |
+ Next, make sure the Kerberos client libraries and the KCM server must agree
|
|
|
ecf709 |
+ on the UNIX socket path. By default, both use the same path
|
|
|
ecf709 |
+ <replaceable>/var/run/.heim_org.h5l.kcm-socket</replaceable>. To configure
|
|
|
ecf709 |
+ the Kerberos library, change its <quote>kcm_socket</quote> option which
|
|
|
ecf709 |
+ is described in the
|
|
|
ecf709 |
+ <citerefentry>
|
|
|
ecf709 |
+ <refentrytitle>krb5.conf</refentrytitle><manvolnum>5</manvolnum>
|
|
|
ecf709 |
+ </citerefentry>
|
|
|
ecf709 |
+ manual page.
|
|
|
ecf709 |
+ </para>
|
|
|
ecf709 |
+ <para>
|
|
|
ecf709 |
+ Finally, make sure the SSSD KCM server can be contacted.
|
|
|
ecf709 |
+ The KCM service is typically socket-activated by
|
|
|
ecf709 |
+ <citerefentry>
|
|
|
ecf709 |
+ <refentrytitle>systemd</refentrytitle>
|
|
|
ecf709 |
+ <manvolnum>1</manvolnum>
|
|
|
ecf709 |
+ </citerefentry>.
|
|
|
ecf709 |
+ Unlike
|
|
|
ecf709 |
+ other SSSD services, it cannot be started by adding the
|
|
|
ecf709 |
+ <quote>kcm</quote> string to the <quote>service</quote>
|
|
|
ecf709 |
+ directive.
|
|
|
ecf709 |
+ <programlisting>
|
|
|
ecf709 |
+systemctl start sssd-kcm.socket
|
|
|
ecf709 |
+systemctl enable sssd-kcm.socket
|
|
|
ecf709 |
+systemctl enable sssd-kcm.service
|
|
|
ecf709 |
+ </programlisting>
|
|
|
ecf709 |
+ Please note your distribution may already configure the units
|
|
|
ecf709 |
+ for you.
|
|
|
ecf709 |
+ </para>
|
|
|
ecf709 |
+ </refsect1>
|
|
|
ecf709 |
+
|
|
|
ecf709 |
+ <refsect1 id='storage'>
|
|
|
ecf709 |
+ <title>THE CREDENTIAL CACHE STORAGE</title>
|
|
|
ecf709 |
+ <para>
|
|
|
ecf709 |
+ The credential caches are stored in the SSSD secrets service (see
|
|
|
ecf709 |
+ <citerefentry>
|
|
|
ecf709 |
+ <refentrytitle>sssd-secrets</refentrytitle><manvolnum>5</manvolnum>
|
|
|
ecf709 |
+ </citerefentry>
|
|
|
ecf709 |
+ for more details). Therefore it is important that also the sssd-secrets
|
|
|
ecf709 |
+ service is enabled and its socket is started:
|
|
|
ecf709 |
+ <programlisting>
|
|
|
ecf709 |
+systemctl start sssd-secrets.socket
|
|
|
ecf709 |
+systemctl enable sssd-secrets.socket
|
|
|
ecf709 |
+systemctl enable sssd-secrets.service
|
|
|
ecf709 |
+ </programlisting>
|
|
|
ecf709 |
+ Your distribution should already set the dependencies between the services.
|
|
|
ecf709 |
+ </para>
|
|
|
ecf709 |
+ </refsect1>
|
|
|
ecf709 |
+
|
|
|
ecf709 |
+ <refsect1 id='options'>
|
|
|
ecf709 |
+ <title>CONFIGURATION OPTIONS</title>
|
|
|
ecf709 |
+ <para>
|
|
|
ecf709 |
+ The KCM service is configured in the <quote>kcm</quote>
|
|
|
ecf709 |
+ section of the sssd.conf file. Please note that currently,
|
|
|
ecf709 |
+ is it not sufficient to restart the sssd-kcm service, because
|
|
|
ecf709 |
+ the sssd configuration is only parsed and read to an internal
|
|
|
ecf709 |
+ configuration database by the sssd service. Therefore you
|
|
|
ecf709 |
+ must restart the sssd service if you change anything in the
|
|
|
ecf709 |
+ <quote>kcm</quote> section of sssd.conf.
|
|
|
ecf709 |
+ For a detailed syntax reference, refer to the <quote>FILE FORMAT</quote> section of the
|
|
|
ecf709 |
+ <citerefentry>
|
|
|
ecf709 |
+ <refentrytitle>sssd.conf</refentrytitle>
|
|
|
ecf709 |
+ <manvolnum>5</manvolnum>
|
|
|
ecf709 |
+ </citerefentry> manual page.
|
|
|
ecf709 |
+ </para>
|
|
|
ecf709 |
+ <para>
|
|
|
ecf709 |
+ The generic SSSD service options such as
|
|
|
ecf709 |
+ <quote>debug_level</quote> or <quote>fd_limit</quote> are
|
|
|
ecf709 |
+ accepted by the kcm service. Please refer to the
|
|
|
ecf709 |
+ <citerefentry>
|
|
|
ecf709 |
+ <refentrytitle>sssd.conf</refentrytitle>
|
|
|
ecf709 |
+ <manvolnum>5</manvolnum>
|
|
|
ecf709 |
+ </citerefentry> manual page for a complete list. In addition,
|
|
|
ecf709 |
+ there are some KCM-specific options as well.
|
|
|
ecf709 |
+ </para>
|
|
|
ecf709 |
+ <variablelist>
|
|
|
ecf709 |
+ <varlistentry>
|
|
|
ecf709 |
+ <term>socket_path (string)</term>
|
|
|
ecf709 |
+ <listitem>
|
|
|
ecf709 |
+ <para>
|
|
|
ecf709 |
+ The socket the KCM service will listen on.
|
|
|
ecf709 |
+ </para>
|
|
|
ecf709 |
+ <para>
|
|
|
ecf709 |
+ Default: <replaceable>/var/run/.heim_org.h5l.kcm-socket</replaceable>
|
|
|
ecf709 |
+ </para>
|
|
|
ecf709 |
+ </listitem>
|
|
|
ecf709 |
+ </varlistentry>
|
|
|
ecf709 |
+ </variablelist>
|
|
|
ecf709 |
+ </refsect1>
|
|
|
ecf709 |
+
|
|
|
ecf709 |
+ <refsect1 id='see_also'>
|
|
|
ecf709 |
+ <title>SEE ALSO</title>
|
|
|
ecf709 |
+ <para>
|
|
|
ecf709 |
+ <citerefentry>
|
|
|
ecf709 |
+ <refentrytitle>sssd</refentrytitle><manvolnum>8</manvolnum>
|
|
|
ecf709 |
+ </citerefentry>,
|
|
|
ecf709 |
+ <citerefentry>
|
|
|
ecf709 |
+ <refentrytitle>sssd.conf</refentrytitle><manvolnum>5</manvolnum>
|
|
|
ecf709 |
+ </citerefentry>,
|
|
|
ecf709 |
+ </para>
|
|
|
ecf709 |
+ </refsect1>
|
|
|
ecf709 |
+</refentry>
|
|
|
ecf709 |
+</reference>
|
|
|
ecf709 |
--
|
|
|
ecf709 |
2.9.3
|
|
|
ecf709 |
|