On Thu, 2012-01-05 at 11:26 +0100, Jakub Hrozek wrote:
> On Wed, Jan 04, 2012 at 08:32:07PM -0500, Stephen Gallagher wrote:
> > On Wed, 2012-01-04 at 22:18 +0100, Jakub Hrozek wrote:
> > >
https://fedorahosted.org/sssd/ticket/1131
> > >
> > > If the SSSD back end goes offline during Kerberos auth, the back end
calls
> > > the child process for the second time in order to create an expired TGT.
> > >
> > > In case the KDC server is used for KPASSWD operation, but the Kerberos
> > > library returns that the KDC is not available during chpass, SSSD would
> > > still attempt to call the krb5_child process for the second time. The
> > > child would still attempt to changepw, which would fail, then SSSD would
> > > go offline again and call the child again etc. The back end would go
> > > into infinite loop.
> > >
> > > A simple test case is to create an IPA user with an expired password,
> > > shut down the ipa_kpasswd process and try to log in.
> >
> > Nack (nitpick).
> >
> > Please use the appropriate DEBUG level macros.
>
> Thanks, new patch is attached.
Ack.