AFS to Windows-Login Change
===========================

References
----------

http://ait.web.psi.ch/services/linux/news/unified_login1.html

Introduction
------------

In the night from August 2 to 3 2009 the AFS authentication service
will be changed to the Windows authentication service on Green SL4 and
SL5 PCs.

This document describes the changes that have to be made in our
cfengine and puppet environments to facilitate the PSI wide automatic
reconfiguration of the Kerberos 5 authentication service on Green SL4
and SL5 systems.

This automatic reconfiguration requires cfengine running on SL4 and
puppet running on SL5 hosts respectively.

Note: For technical reasons SL3 systems can not use the Windows
authentication service.

Basically, the following two steps have to be performed:

- Replace the current `krb5.conf` for the AFS authentication service by
  the new `krb5.conf` for the Windows authentication service.

- Distribute the `krenew.sh` script, which periodically renews an
  existing renewable ticket.  It starts running when the user logs in
  to its graphical desktop.


For additional information see the reference.

Files
-----

`/etc/krb5.conf` for the Windows authentication server for SL4 and
SL5::

	[libdefaults]
		default_realm = D.PSI.CH
		ticket_lifetime = 25h
		dns_lookup_realm = false
		dns_lookup_kdc = false
		udp_preference_limit = 10
		renew_lifetime = 30d
		forwardable = true

	[realms]
		PSI.CH = {
			kdc = afs00.psi.ch:88 afs01.psi.ch:88 afs02.psi.ch:88
			admin_server = afs00.psi.ch:749
			kpasswd_server = afs00.psi.ch:464
			default_domain = psi.ch
		}
		D.PSI.CH = {
			kdc = d.psi.ch.
			kpasswd_server = d.psi.ch.
			default_domain = psi.ch
		}
	[domain_realm]
		.psi.ch = D.PSI.CH


To automatically renew a Kerberos v5 ticket during an X session the
krenew command will be started when logging in to X. It is executed by
the script `krenew.sh`, which is placed into
`/etc/X11/xinit/xinitrc.d/`.

`/etc/X11/xinit/xinitrc.d/krenew.sh` for SL4 and SL5::

	#!/bin/bash

	/usr/bin/krenew -b -K 60 -t 


Procedure
---------

SL4
~~~

Replace `krb5.conf` File by Cfengine
....................................

The replacement of the `krb5.conf` is done by cfengine
on Green SL4 systems.

The current `krb5.conf` source files::

    /afs/psi.ch/service/linux/cfengine/masterfiles/distTesting/scientific/46/etc/krb5.conf

and::

    /afs/psi.ch/service/linux/cfengine/masterfiles/dist/scientific/46/etc/krb5.conf

have to be replaced by the `krb5.conf` file for the Windows
authentication server.


Distribute `krenew.sh` By Cfengine
..................................

Copy `krenew.sh` to::

    /afs/psi.ch/service/linux/cfengine/masterfiles/distTesting/scientific/46/etc/

and::

    /afs/psi.ch/service/linux/cfengine/masterfiles/dist/scientific/46/etc/


Configure cfengine to distribute them by adding the following entry to::

    /afs/psi.ch/service/linux/cfengine/masterfiles/inputsTesting/scientific/46/cf.linux.AFS

and::

    /afs/psi.ch/service/linux/cfengine/masterfiles/inputs/scientific/46/cf.linux.AFS


The entry::

	linux.scientific::
	     $(MASTERDIR)/$(DISTDIR)/$(DIST)/$(RELEASE)/etc/krenew.sh
					owner=root group=root
					mode=0755
					dest=/etc/X11/xinit/xinitrc.d/krenew.sh
					type=sum     # makes a MD5 checksum
					server=$(MASTERHOST)
					backup=true
					syslog=true


SL5
---

Replace `krb5.conf` File by Puppet
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The replacement of the `krb5.conf` is done by puppet on Green SL5
systems.

The corresponding `krb5.conf` source file::

    /afs/psi.ch/software/linux/dist/scientific/51/puppet/files/afs/etc/krb5.conf

has to be replaced by the `krb5.conf` file for the Windows
authentication server.

Distribute `krenew.sh` By Puppet
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copy `krenew.sh` to the following puppet directory::

    /afs/psi.ch/software/linux/dist/scientific/51/puppet/files/afs/etc/

Now edit the puppet manifest `psi_afs.pp` in both environments,
production development. Add `krenew.sh` to the file resource type as
shown below.

`/afs/psi.ch/service/linux/puppet/etc/puppet/development/manifests/psi_defaults/psi_afs.pp`,

`/afs/psi.ch/service/linux/puppet/etc/puppet/production/manifests/psi_defaults/psi_afs.pp`::

    # psi_afs.pp
    #
    # Link to PSI pam files
    # Default PAM configuration for PSI systems
    #
    
    
    class psi_afs {
    
    	file {
    		"/etc/krb5.conf":
    			owner => "root",
    			group => "root",
    			source => [
    				"puppet://$servername/$psi_release/afs/etc/krb5.conf.$hostname",
    				"puppet://$servername/$psi_release/afs/etc/krb5.conf"
    			];
    
    		"/etc/X11/xinit/xinitrc.d/krenew.sh":
    			owner => "root",
    			group => "root",
    			mode => "755",
    			source => [
    				"puppet:///$psi_release/afs/etc/krenew.sh.$hostname",
    				"puppet:///$psi_release/afs/etc/krenew.sh"
    			];
    	}
    
    }
