On Wed, May 31, 2017 at 10:31:38AM +0200, Lukas Slebodnik wrote:
ehlo,
I had a discussion with QEs and realized that sssd need to be restarted
if default_ccache_name is changed in krb5 configuration files.
The reason is that we cache the value but do not refresh it.
https://pagure.io/SSSD/sssd/blob/master/f/src/providers/krb5/krb5_common....
We might changed that using inotify. But we would need to change.
I am not sure whether it will be trivail to change because we would need to
change cached value in "struct dp_option *opts" for all domains (including
subdomains)
A more simple approach might be to call sss_get_system_ccname_template()
in krb5_auth_prepare_ccache_name() are read the value for every
authentication or try to move all of this to krb5_child which always
reads the current krb5.conf.
ATM the safest way is to restart sssd. But do we want to be more flexible here?
I just checked with sshd and delegation and it looks like sshd picks up
the changes without a restart because the forked sshd child will call
krb5_init_context() for each new connection. So I think it would be nice
if SSSD can respect the change as will without restart. But I do not
consider this an urgent issue.
bye,
Sumit
>
> LS
> _______________________________________________
> sssd-devel mailing list -- sssd-devel(a)lists.fedorahosted.org
> To unsubscribe send an email to sssd-devel-leave(a)lists.fedorahosted.org