On Tue, Jun 25, 2013 at 11:25:32AM +0200, Sumit Bose wrote:
On Mon, Jun 24, 2013 at 06:22:35PM +0200, Jakub Hrozek wrote:
> On Mon, Jun 24, 2013 at 04:28:10PM +0100, David Woodhouse wrote:
> > On Mon, 2013-06-24 at 17:01 +0200, Jakub Hrozek wrote:
> > > On Mon, Jun 24, 2013 at 04:59:33PM +0200, Jakub Hrozek wrote:
> > > > On Mon, Jun 24, 2013 at 04:23:46PM +0200, Sumit Bose wrote:
> > > > > Hi,
> > > > >
> > > > > David Woodhouse identified an issue with Kerberos ticket
renewal.
> > > > > Attached two patches fix two issues related to the authtok
refactoring
> > > > > which make renewal for me working again.
> > > > >
> > > > > bye,
> > > > > Sumit
> > > >
> > > > Works for me, too. Ack.
> > >
> > > Pushed both to master.
> >
> > An improvement, but still not working.
> >
> > Firstly I have to revert commit 3438815242464a963c0d3a70f16579723a20b52d
> > ("LDAP: Retry SID search based on result of LDAP search, not the return
> > code") because otherwise I can't log in at all (I sent logs in
private
> > mail).
> >
>
> The login failure is not related to the commit per se, the commit is
> actually correct and gets you further in the login process, but then you
> hit the old bug with the referral. I'm still not quite sure why SSSD
> decided to contact LDAP there and not the GC.
>
> > Then it does actually seem to be *trying* to renew, but I get the
> > following:
> >
>
> [snip]
>
> > FWIW running 'kinit -R' manually does work.
>
> As discussed on #sssd, this is a bug in how we renew enterprise
> principals.
The attached patch should fix the issue by not using enterprise
principals for renewals. David was so kind to test it and gave positive
feedback via irc.
bye,
Sumit
The code looks good to me and David confirmed off-list that it fixed his
issue, too.
Ack.