Re: GSSAPI for various murder component setups

2012-06-25 Thread Stephen Ingram
On Sat, Jun 23, 2012 at 10:55 PM, Stephen Ingram wrote: > On Thu, Jun 14, 2012 at 9:14 PM, Dan White wrote: > > ...snip... > >> You can control whether clients will get referrals via the >> proxyd_disable_mailbox_referrals option. >> >> When proxying, you would configure the 'cyrus-' user within

Re: GSSAPI for various murder component setups

2012-06-23 Thread Stephen Ingram
On Thu, Jun 14, 2012 at 9:14 PM, Dan White wrote: ...snip... > You can control whether clients will get referrals via the > proxyd_disable_mailbox_referrals option. > > When proxying, you would configure the 'cyrus-' user within > the proxyservers option on the backend. When the frontend authent

Re: GSSAPI for various murder component setups

2012-06-23 Thread Stephen Ingram
On Thu, Jun 14, 2012 at 9:14 PM, Dan White wrote: ...snip... > You can control whether clients will get referrals via the > proxyd_disable_mailbox_referrals option. > > When proxying, you would configure the 'cyrus-' user within > the proxyservers option on the backend. When the frontend authent

Re: GSSAPI for various murder component setups

2012-06-23 Thread Dan White
On 06/22/12 11:31 -0700, Stephen Ingram wrote: >One other question though, how often do you refresh your credential >cache? From the few examples I've seen, most people seem to refresh >very frequently (anywhere from 6 minutes to 1 hour). Given that most >tickets can last up to 10 or 12 hours, I'm

Re: GSSAPI for various murder component setups

2012-06-22 Thread Stephen Ingram
On Wed, Jun 20, 2012 at 6:29 AM, Dan White wrote: > On 06/19/12 19:04 -0700, Stephen Ingram wrote: >> >> Thank you for your continued help with this. I really appreciate it >> and am determined to get to the end of this. >> >> I think I'm getting closer. I have successfully authenticated using >>

Re: GSSAPI for various murder component setups

2012-06-20 Thread Dan White
On 06/19/12 19:04 -0700, Stephen Ingram wrote: >Thank you for your continued help with this. I really appreciate it >and am determined to get to the end of this. > >I think I'm getting closer. I have successfully authenticated using >mupdatetest from one of the backends to the mupdate server. I'm u

Re: GSSAPI for various murder component setups

2012-06-19 Thread Stephen Ingram
On Sun, Jun 17, 2012 at 8:21 PM, Dan White wrote: > On 06/17/12 18:04 -0700, Stephen Ingram wrote: >> >> On Thu, Jun 14, 2012 at 9:14 PM, Dan White wrote: >> >> ...snip... >> >>> Another way to keep your principals straight is that you'll need a user >>> principal where you will run the *test uti

Re: GSSAPI for various murder component setups

2012-06-17 Thread Dan White
On 06/17/12 18:04 -0700, Stephen Ingram wrote: >On Thu, Jun 14, 2012 at 9:14 PM, Dan White wrote: > >...snip... > >> Another way to keep your principals straight is that you'll need a user >> principal where you will run the *test utilities, and a service principal >> on the server that the *test

Re: GSSAPI for various murder component setups

2012-06-17 Thread Stephen Ingram
On Thu, Jun 14, 2012 at 9:14 PM, Dan White wrote: ...snip... > Another way to keep your principals straight is that you'll need a user > principal where you will run the *test utilities, and a service principal > on the server that the *test utility will connect to. > > The service principals wi

Re: GSSAPI for various murder component setups

2012-06-15 Thread Dennis Davis
On Wed, 13 Jun 2012, Dan White wrote: > From: Dan White > To: Stephen Ingram > Cc: info-cyrus > Date: Wed, 13 Jun 2012 21:23:57 > Subject: Re: GSSAPI for various murder component setups ... > The other issue is that where your systems are acting as clients > (such as w

Re: GSSAPI for various murder component setups

2012-06-14 Thread Dan White
On 06/14/12 17:20 -0700, Stephen Ingram wrote: >On Thu, Jun 14, 2012 at 7:05 AM, Dan White wrote: >> Every service listed within your SERVICES section in cyrus.conf will >> potentially need it's own service principal, particularly on your backends >> and mupdate master. Your frontends may not need

Re: GSSAPI for various murder component setups

2012-06-14 Thread Stephen Ingram
On Thu, Jun 14, 2012 at 7:05 AM, Dan White wrote: > On 06/13/12 21:02 -0700, Stephen Ingram wrote: >> >> On Wed, Jun 13, 2012 at 1:23 PM, Dan White wrote: >>> >>> The other issue is that where your systems are acting as clients (such as >>> when a frontend server is connecting to an mupdate serve

Re: GSSAPI for various murder component setups

2012-06-14 Thread Stephen Ingram
On Thu, Jun 14, 2012 at 6:20 AM, Dave McMurtrie wrote: > On 06/14/2012 12:02 AM, Stephen Ingram wrote: > >> This is exactly the part I'm really confused about. For murder, I see >> connections from the frontends and backends to the mupdate server. I >> also see connections from the frontends to th

Re: GSSAPI for various murder component setups

2012-06-14 Thread Dan White
On 06/13/12 21:02 -0700, Stephen Ingram wrote: >On Wed, Jun 13, 2012 at 1:23 PM, Dan White wrote: >> The other issue is that where your systems are acting as clients (such as >> when a frontend server is connecting to an mupdate server), your client >> will need to initialize a kerberos ticket cac

Re: GSSAPI for various murder component setups

2012-06-14 Thread Dave McMurtrie
On 06/14/2012 12:02 AM, Stephen Ingram wrote: > This is exactly the part I'm really confused about. For murder, I see > connections from the frontends and backends to the mupdate server. I > also see connections from the frontends to the backends. The > connections to the mupdate server are, in a

Re: GSSAPI for various murder component setups

2012-06-13 Thread Stephen Ingram
On Wed, Jun 13, 2012 at 1:23 PM, Dan White wrote: > On 06/13/12 12:57 -0700, Stephen Ingram wrote: >> >> There seems to be quite a bit of information on the Website about >> setting up a murder configuration. Most of the documentation, however, >> seems to be centered on basic authentication. Is t

Re: GSSAPI for various murder component setups

2012-06-13 Thread Dan White
On 06/13/12 12:57 -0700, Stephen Ingram wrote: >There seems to be quite a bit of information on the Website about >setting up a murder configuration. Most of the documentation, however, >seems to be centered on basic authentication. Is there a good resource >somewhere to using Kerberos to setup the

Re: GSSAPI for various murder component setups

2012-06-13 Thread Dave McMurtrie
On 06/13/2012 03:57 PM, Stephen Ingram wrote: > There seems to be quite a bit of information on the Website about > setting up a murder configuration. Most of the documentation, however, > seems to be centered on basic authentication. Is there a good resource > somewhere to using Kerberos to setup

GSSAPI for various murder component setups

2012-06-13 Thread Stephen Ingram
There seems to be quite a bit of information on the Website about setting up a murder configuration. Most of the documentation, however, seems to be centered on basic authentication. Is there a good resource somewhere to using Kerberos to setup the communication between the mupdate, frontend and ba