SASL support for kldap

[Greg Hudson]

On 11/14/2011 12:22 AM, Chris Hecker wrote:
> Any hope of getting this integrated into the trunk?

We have been regrettably slow about processing this work, due to
resource constraints.  I do have some notes about it, which I should
have sent long ago:

* There is a lot of duplication of parameter names for
KDC/kadmind/kpasswdd.  It turns out that kpasswdd isn't a separate
service as far as the DAL is concerned (there's a constant defined for
it but it's never used).  Beyond that, we'd want to introduce a more
structured convention for differentiating LDAP options between the KDC
and kadmind before introducing 13 new config parameters with global,
KDC, and kadmind variants.

* There's also a lot of repeated code for processing these options.
That would need to be refactored.

* We would need to document this while integrating it, since the patch
doesn't include amendments to our texinfo documentation (or the RST
conversion of it).

* We would need to test this, at least manually, while integrating it,
which requires a fair amount of spin-up time on OpenLDAP setup.  (Adding
automated testing for the LDAP back end is on my private hit list for
1.11, but I don't know if testing SASL access is likely to be feasible
when I do that.)