On Fri, Mar 20, 2015 at 11:52:03AM +0100, Pavel Reichl wrote:
On 03/20/2015 11:26 AM, Sumit Bose wrote:
>On Thu, Mar 19, 2015 at 05:28:40PM +0100, Pavel Reichl wrote:
>>While testing some patches I could not authenticate as IPA user, problem was
>>that there was time skew about 30 minutes between IPA server and IPA client.
>>Attached patch should provide clear hint about this possibility.
>>
>>Thanks.
>> From f84d1e19da7b79cd51e541033d09ef72dccb9505 Mon Sep 17 00:00:00 2001
>>From: Pavel Reichl <preichl(a)redhat.com>
>>Date: Thu, 19 Mar 2015 11:16:53 -0400
>>Subject: [PATCH] KRB5: add debug hint
>>
>>---
>> src/providers/krb5/krb5_child.c | 2 ++
>> 1 file changed, 2 insertions(+)
>>
>>diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
>>index
8fb2e6b2f5565f6594e03b9c45f0ab50e9eed17e..03245bdfce6b44803d344eb5d1e702b5e5bb161f 100644
>>--- a/src/providers/krb5/krb5_child.c
>>+++ b/src/providers/krb5/krb5_child.c
>>@@ -1896,6 +1896,8 @@ static krb5_error_code check_fast_ccache(TALLOC_CTX
*mem_ctx,
>> if (tgtt.endtime < time(NULL)) {
>> DEBUG(SSSDBG_OP_FAILURE,
>> "Valid FAST TGT not found after attempting to renew
it\n");
>>+ DEBUG(SSSDBG_TRACE_FUNC,
>>+ "Please check that time is synchronized with
server.\n");
>I think the hint is good at this point but I would suggest to just merge
>it with the previous message. Since the expiriation time is checked
>explicitly here for the renewed ticket something like "FAST TGT was
>renewed but is already expired, please check that time is synchronized
>with server." might be suitable?
>
>bye,
>Sumit
Sure, thanks for comment. Please see updated patch.
ACK
bye,
Sumit