On 05/06/2010 09:25 AM, Sumit Bose wrote:
On Wed, May 05, 2010 at 09:41:10AM -0400, Stephen Gallagher wrote:
> On 05/05/2010 05:02 AM, Sumit Bose wrote
>>
>> rebased version which should work on top of 'Handle Krb5 password
>> expiration warning' is attached.
>>
>
> Nack: please update the sssd.spec to BuildRequires: keyutils-libs-devel
> and Requires: keyutils-libs
done
>
> Please reduce krb5_ctx->delayed_online_authentication to
> krb5_ctx->deferred_auth. It's much too long and will be difficult to
> keep within our 79-character limit.
>
> Simmilarly, 'struct delayed_online_authentication' should probably be
> 'struct deferred_auth_ctx' (naming it a context makes it less confusing.
> My first impression of the line:
> ret = get_uid_table(delayed_online_authentication,&uid_table);
> was that you were passing in a function pointer here.
done
>
> In delayed_online_authentication_callback(), reduce the DEBUG message to
> level 5.
done
>
> authenticate_stored_users() depends on get_uid_table() returning True,
> which will only happen on Linux. We should do a get_uid_table() call in
> init_delayed_online_authentication() and skip setting up the online
> callback if this feature is unavailable. (With a 0-level DEBUG message
> saying that delayed online auth was requested on an unsupported system)
> The manpage should also mention that this feature is available only on
> Linux.
>
done
>
> authenticate_user():
> Do we want to revoke the key here? I think we might want to hold onto it
> until authenticate_user_done(). That way if it fails (the KDC may be
> offline, even though the LDAP provider is online) we can hang onto the
> creds and try again the next time we go online.
>
This is not necessary because the delayed request is handled like an
ordinary auth request. If the KDC is offline the request is added to the
list of delayed requests again.
New version attached.
bye,
Sumit
Nack
This feature is not working properly. I'll describe my testing steps
below. (I used IPA for this)
As root on the client, I added
krb5_store_password_if_offline = true
to the sssd.conf.
I then made sure there were no users logged in but root and removed
/tmp/krb5cc*
I turned off my IPA server and sshed into the machine with a user that
had cached credentials. Offline auth happened as expected.
I then turned my IPA server back on, waited 60s and then performed a
getent request to get the machine to go online.
I saw in the logs that it went online and performed the deferred kinit.
However, klist on the logged-in user did not show a tgt. Checking in
/tmp, I saw two krb5cc* files for the same userid.
It looks like the auto-kinit code is not recognizing an existing ccache.
--
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/