On Wed, 2012-01-04 at 22:18 +0100, Jakub Hrozek wrote:
https://fedorahosted.org/sssd/ticket/1131
If the SSSD back end goes offline during Kerberos auth, the back end calls
the child process for the second time in order to create an expired TGT.
In case the KDC server is used for KPASSWD operation, but the Kerberos
library returns that the KDC is not available during chpass, SSSD would
still attempt to call the krb5_child process for the second time. The
child would still attempt to changepw, which would fail, then SSSD would
go offline again and call the child again etc. The back end would go
into infinite loop.
A simple test case is to create an IPA user with an expired password,
shut down the ipa_kpasswd process and try to log in.
Nack (nitpick).
Please use the appropriate DEBUG level macros.