On Wed, Jan 04, 2012 at 08:32:07PM -0500, Stephen Gallagher wrote:
> On Wed, 2012-01-04 at 22:18 +0100, Jakub Hrozek wrote:
> >
https://fedorahosted.org/sssd/ticket/1131
> >
> > If the SSSD back end goes offline during Kerberos auth, the back end calls
> > the child process for the second time in order to create an expired TGT.
> >
> > In case the KDC server is used for KPASSWD operation, but the Kerberos
> > library returns that the KDC is not available during chpass, SSSD would
> > still attempt to call the krb5_child process for the second time. The
> > child would still attempt to changepw, which would fail, then SSSD would
> > go offline again and call the child again etc. The back end would go
> > into infinite loop.
> >
> > A simple test case is to create an IPA user with an expired password,
> > shut down the ipa_kpasswd process and try to log in.
>
> Nack (nitpick).
>
> Please use the appropriate DEBUG level macros.
Thanks, new patch is attached.