On 05/05/2010 05:02 AM, Sumit Bose wrote
rebased version which should work on top of 'Handle Krb5 password
expiration warning' is attached.
Nack: please update the sssd.spec to BuildRequires: keyutils-libs-devel
and Requires: keyutils-libs
Please reduce krb5_ctx->delayed_online_authentication to
krb5_ctx->deferred_auth. It's much too long and will be difficult to
keep within our 79-character limit.
Simmilarly, 'struct delayed_online_authentication' should probably be
'struct deferred_auth_ctx' (naming it a context makes it less confusing.
My first impression of the line:
ret = get_uid_table(delayed_online_authentication, &uid_table);
was that you were passing in a function pointer here.
In delayed_online_authentication_callback(), reduce the DEBUG message to
level 5.
authenticate_stored_users() depends on get_uid_table() returning True,
which will only happen on Linux. We should do a get_uid_table() call in
init_delayed_online_authentication() and skip setting up the online
callback if this feature is unavailable. (With a 0-level DEBUG message
saying that delayed online auth was requested on an unsupported system)
The manpage should also mention that this feature is available only on
Linux.
authenticate_user():
Do we want to revoke the key here? I think we might want to hold onto it
until authenticate_user_done(). That way if it fails (the KDC may be
offline, even though the LDAP provider is online) we can hang onto the
creds and try again the next time we go online.
--
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/