Cannot elide admin_servers from debconf config

[Daniel Richard G.]

Binary package hint: krb5-config

I want to set up /etc/krb5.conf via debconf so that the file specifies "kdc" for my Kerberos realm, but not "admin_server" (nor "kpasswd") because I want those to be found via DNS.

If I do the logical thing, however---give a value for krb5-config/kerberos_servers, but leave krb5-config/admin_server empty---the config script does not create a clause under [realms] at all. It should be creating a clause with a "kdc" line and nothing more.

(Background: This is an enterprise scenario. DNS points to a long list of remote authoritative KDCs. Because these KDCs are remote, and also buggy [long story] we would rather use a local read-only KDC for normal authentication. But obviously, admin_server and kpasswd have to go to the authoritative KDCs.)

[Chuck Short (zulcss)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. Unfortunately, we can't fix it because your description didn't include enough information. You may find it helpful to read "How to report bugs effectively" http://www.chiark.greenend.org.uk/~sgtatham/bugs.html. We'd be grateful if you would then provide a more complete description of the problem. We have instructions on debugging some types of problems at http://wiki.ubuntu.com/DebuggingProcedures.
At a minimum, we need:
1. the specific steps or actions you took that caused you to encounter the problem,
2. the behavior you expected, and
3. the behavior you actually encountered (in as much detail as possible).
Thanks!

When reporting bugs in the future please use apport, either via the appropriate application's "Help -> Report a Problem" menu or using 'ubuntu-bug' and the name of the package affected. You can learn more about this functionality at https://wiki.ubuntu.com/ReportingBugs.

[Chuck Short (zulcss)]

We'd like to figure out what's causing this bug for you, but we haven't heard back from you in a while. Could you please provide the requested information? Thanks!

[Daniel Richard G. (skunk)]

Sorry for not following up sooner.

I want to set up my /etc/krb5.conf file via debconf, as is currently implemented, but I want to do things a little differently from what the scripts have been written to do.

Normally, you'd specify something like this in debconf:

    krb5-config/kerberos_servers: server1.realm.com server2.realm.com
    krb5-config/default_realm: REALM.COM
    krb5-config/admin_server: admin-server.realm.com

Which would result in a clause in /etc/krb5.conf like

    [realms]
 REALM.COM = {
  kdc = server1.realm.com
  kdc = server2.realm.com
  admin_server = admin-server.realm.com
 }

But I want a krb5.conf clause that *does not specify* an "admin_server", only "kdc"s. (I want to use an explicitly specified KDC, but allow the Kerberos admin server to be located via DNS.)

Presumably, you would set an empty value for admin_server in debconf, and the scripts would give the desired result. But at present, an empty admin_server value causes the "REALM.COM = { ... }" clause not to be generated *at all*. It's the same behavior you get if you enable the debconf krb5-config/dns_for_default option.

The bug is that debconf will process only both items (kdc + admin_server) or none, where it should be allowing the flexibility to use just one or the other.

[Daniel Richard G. (skunk)]

Please let me know if any further information is needed.