On Thu, May 06, 2010 at 02:10:08PM -0400, Stephen Gallagher wrote:
On 05/06/2010 09:25 AM, Sumit Bose wrote:
> On Wed, May 05, 2010 at 09:41:10AM -0400, Stephen Gallagher wrote:
>> On 05/05/2010 05:02 AM, Sumit Bose wrote
>>> rebased version which should work on top of 'Handle Krb5 password
>>> expiration warning' is attached.
>> Nack: please update the sssd.spec to BuildRequires: keyutils-libs-devel
>> and Requires: keyutils-libs
>> Please reduce krb5_ctx->delayed_online_authentication to
>> krb5_ctx->deferred_auth. It's much too long and will be difficult to
>> keep within our 79-character limit.
>> Simmilarly, 'struct delayed_online_authentication' should probably be
>> 'struct deferred_auth_ctx' (naming it a context makes it less
>> My first impression of the line:
>> ret = get_uid_table(delayed_online_authentication,&uid_table);
>> was that you were passing in a function pointer here.
>> In delayed_online_authentication_callback(), reduce the DEBUG message to
>> level 5.
>> authenticate_stored_users() depends on get_uid_table() returning True,
>> which will only happen on Linux. We should do a get_uid_table() call in
>> init_delayed_online_authentication() and skip setting up the online
>> callback if this feature is unavailable. (With a 0-level DEBUG message
>> saying that delayed online auth was requested on an unsupported system)
>> The manpage should also mention that this feature is available only on
>> Do we want to revoke the key here? I think we might want to hold onto it
>> until authenticate_user_done(). That way if it fails (the KDC may be
>> offline, even though the LDAP provider is online) we can hang onto the
>> creds and try again the next time we go online.
> This is not necessary because the delayed request is handled like an
> ordinary auth request. If the KDC is offline the request is added to the
> list of delayed requests again.
> New version attached.
This feature is not working properly. I'll describe my testing steps
below. (I used IPA for this)
As root on the client, I added
krb5_store_password_if_offline = true
to the sssd.conf.
I then made sure there were no users logged in but root and removed
I turned off my IPA server and sshed into the machine with a user that
had cached credentials. Offline auth happened as expected.
I then turned my IPA server back on, waited 60s and then performed a
getent request to get the machine to go online.
I saw in the logs that it went online and performed the deferred kinit.
However, klist on the logged-in user did not show a tgt. Checking in
/tmp, I saw two krb5cc* files for the same userid.
It looks like the auto-kinit code is not recognizing an existing ccache.
Thanks for catching this, it looks that there was always a ccache
available during my testing. New version attached.
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
sssd-devel mailing list