On Wed, Jan 04, 2012 at 08:32:07PM -0500, Stephen Gallagher wrote:
On Wed, 2012-01-04 at 22:18 +0100, Jakub Hrozek wrote:
>
https://fedorahosted.org/sssd/ticket/1131
>
> If the SSSD back end goes offline during Kerberos auth, the back end calls
> the child process for the second time in order to create an expired TGT.
>
> In case the KDC server is used for KPASSWD operation, but the Kerberos
> library returns that the KDC is not available during chpass, SSSD would
> still attempt to call the krb5_child process for the second time. The
> child would still attempt to changepw, which would fail, then SSSD would
> go offline again and call the child again etc. The back end would go
> into infinite loop.
>
> A simple test case is to create an IPA user with an expired password,
> shut down the ipa_kpasswd process and try to log in.
Nack (nitpick).
Please use the appropriate DEBUG level macros.
Thanks, new patch is attached.