Projects/Host-realm pluggable interface - Revision history

Ghudson at 18:05, 16 August 2013

2013-08-16T18:05:42Z

Ghudson: /* Mailing list discussions */

2013-08-08T14:41:31Z

‎Mailing list discussions

Ghudson: /* Mailing list discussions */

2013-08-08T14:40:57Z

‎Mailing list discussions

Ghudson at 03:49, 8 August 2013

2013-08-08T03:49:53Z

Ghudson at 23:39, 7 August 2013

2013-08-07T23:39:53Z

Ghudson at 19:45, 28 June 2013

2013-06-28T19:45:54Z

Ghudson at 15:41, 28 June 2013

2013-06-28T15:41:00Z

Ghudson: /* Scope questions */

2013-06-28T15:18:37Z

‎Scope questions

Ghudson: /* Scope questions */

2013-06-18T17:59:40Z

‎Scope questions

Ghudson: /* Background */

2013-06-17T16:06:58Z

‎Background

@@ Line 1: / Line 1: @@
-{{project-target|1.12}}
+{{project-rel|1.12}}
 ==Description==
@@ Line 110: / Line 110: @@
 ==Commits==
 ==Release notes==

@@ Line 107: / Line 107: @@
 ==Mailing list discussions==
-http://mailman.mit.edu/pipermail/krbdev/2013-June/011611.html
+* http://mailman.mit.edu/pipermail/krbdev/2013-June/011611.html
-http://mailman.mit.edu/pipermail/krbdev/2013-August/011681.html
+* http://mailman.mit.edu/pipermail/krbdev/2013-August/011681.html
 ==Commits==

← Older revision		Revision as of 14:40, 8 August 2013
Line 108:		Line 108:

	http://mailman.mit.edu/pipermail/krbdev/2013-June/011611.html		http://mailman.mit.edu/pipermail/krbdev/2013-June/011611.html
		+	http://mailman.mit.edu/pipermail/krbdev/2013-August/011681.html

	==Commits==		==Commits==

← Older revision		Revision as of 03:49, 8 August 2013
Line 1:		Line 1:
−	{{project-~~early~~}}	+	{{project-target\|1.12}}
		+	{{project-review\|2013-08-14}}

	==Description==		==Description==

← Older revision		Revision as of 23:39, 7 August 2013
Line 95:		Line 95:

	* If modules are explicitly enabled with enable_only, the order of the enable_only list determines the order of the modules.		* If modules are explicitly enabled with enable_only, the order of the enable_only list determines the order of the modules.
		+
		+	==Testing==
		+
		+	A test module will be added to plugins/hostrealm, to be built by default but not installed. A test harness and script will use the module to exercise the pluggable interface.
		+
		+	==Documentation==
		+
		+	A new page under doc/plugindev will document the pluggable interface. krb5_conf.rst will be amended to briefly describe the interface.
		+
		+	==Mailing list discussions==
		+
		+	http://mailman.mit.edu/pipermail/krbdev/2013-June/011611.html
		+
		+	==Commits==
		+
		+	==Release notes==
		+
		+	Developer experience:
		+
		+	* Add a plugin interface to control hostname-to-realm mappings and the default realm.

← Older revision		Revision as of 19:45, 28 June 2013
Line 73:		Line 73:

	* Return any other error code to terminate processing.		* Return any other error code to terminate processing.
		+
		+	===Built-in modules===
		+
		+	The following built-in modules will be provided to implement the current built-in behavior:
		+
		+	* The "profile" module will provide a host_realm method using the [domain_realm] section of the profile and a default_realm method using the default_realm profile variable.
		+
		+	* The "dns" module will provide fallback_realm and default_realm methods using DNS TXT records, if the dns_realm profile variable is set.
		+
		+	* The "domain" module will provide a fallback_realm method using the domain heuristics.
		+
		+	The final fallback heuristic (using the default realm) will a hardcoded behavior, used if no module returns a result for fallback_realm.

	===Plugin module ordering===		===Plugin module ordering===

← Older revision		Revision as of 15:41, 28 June 2013
Line 45:		Line 45:
	* Hostname "cleaning" (converting to lowercase and removing trailing periods)		* Hostname "cleaning" (converting to lowercase and removing trailing periods)

⚫	==Plugin module ordering==
		+	==Design==
		+
		+	===Pluggable interface===
		+
		+	The new pluggable interface will be named "hostrealm" and will have the following methods (plus initialization and finalization methods):
		+
		+	krb5_error_code (*host_realm)(krb5_context context,
		+	krb5_hostrealm_moddata data,
		+	const char host, char **realms_out);
		+
		+	krb5_error_code (*fallback_realm)(krb5_context context,
		+	krb5_hostrealm_moddata data,
		+	const char host, char **realms_out);
		+
		+	krb5_error_code (*default_realm)(krb5_context context,
		+	krb5_hostrealm_moddata data,
		+	char ***realms_out);
		+
		+	void (*free_list_fn)(krb5_context context, krb5_hostrealm_moddata data,
		+	char **list);
		+
		+	Each of the three query functions may:
		+
		+	* Place a list of realms in *realms_out and return 0. Only the first answer will be consumed by current code, but subsequent answers may be used in the future.
		+
		+	* Return KRB5_PLUGIN_NO_HANDLE to defer to later modules.
		+
		+	* Return any other error code to terminate processing.
		+
		⚫	===Plugin module ordering===

	This is the fourth pluggable interface (after locate, ccselect, and localauth) which have no natural way to order modules, and whose accumulator behavior is order-dependent for some operations. We can improve the predictability of these interfaces by providing a well-defined order for plugin modules. This project proposes the following ordering constraints, which do not require the addition of any new user-visible options or internal APIs:		This is the fourth pluggable interface (after locate, ccselect, and localauth) which have no natural way to order modules, and whose accumulator behavior is order-dependent for some operations. We can improve the predictability of these interfaces by providing a well-defined order for plugin modules. This project proposes the following ordering constraints, which do not require the addition of any new user-visible options or internal APIs:

@@ Line 31: / Line 31: @@
 The behavior of these functions has changed over time.  Prior to the introduction of TGS referral support in 1.6, we did not have krb5_get_fallback_host_realm(), and krb5_get_host_realm() applied most of the heuristics currently applied by that function.
-==Scope questions==
+==Scope==
-* Should plugin modules be able to return multiple answers?
+* The ability to return multiple answers
 ==Plugin module ordering==

@@ Line 33: / Line 33: @@
 ==Scope questions==
-krb5_get_host_realm() and krb5_get_default_realm() are clearly in scope.
+krb5_get_host_realm() and krb5_get_fallback_host_realm() are clearly in scope.
 * Should krb5_get_default_realm() be in scope?

@@ Line 23: / Line 23: @@
 ** We can use the default realm.
-* krb5_get_default_realm() only uses the profile default_realm value.
+* krb5_get_default_realm() uses the profile default_realm value.  If this value is not set, it can use a TXT record lookup of the local hostname with explicit configuration.
 krb5_get_host_realm() and krb5_get_fallback_realm() "clean" their input hostname by converting it to lower-case and removing any trailing period.