On 03/20/2015 11:26 AM, Sumit Bose wrote:
On Thu, Mar 19, 2015 at 05:28:40PM +0100, Pavel Reichl wrote:
> While testing some patches I could not authenticate as IPA user, problem was
> that there was time skew about 30 minutes between IPA server and IPA client.
> Attached patch should provide clear hint about this possibility.
>
> Thanks.
> From f84d1e19da7b79cd51e541033d09ef72dccb9505 Mon Sep 17 00:00:00 2001
> From: Pavel Reichl <preichl(a)redhat.com>
> Date: Thu, 19 Mar 2015 11:16:53 -0400
> Subject: [PATCH] KRB5: add debug hint
>
> ---
> src/providers/krb5/krb5_child.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
> index
8fb2e6b2f5565f6594e03b9c45f0ab50e9eed17e..03245bdfce6b44803d344eb5d1e702b5e5bb161f 100644
> --- a/src/providers/krb5/krb5_child.c
> +++ b/src/providers/krb5/krb5_child.c
> @@ -1896,6 +1896,8 @@ static krb5_error_code check_fast_ccache(TALLOC_CTX *mem_ctx,
> if (tgtt.endtime < time(NULL)) {
> DEBUG(SSSDBG_OP_FAILURE,
> "Valid FAST TGT not found after attempting to renew
it\n");
> + DEBUG(SSSDBG_TRACE_FUNC,
> + "Please check that time is synchronized with server.\n");
I think the hint is good at this point but I would suggest to just merge
it with the previous message. Since the expiriation time is checked
explicitly here for the renewed ticket something like "FAST TGT was
renewed but is already expired, please check that time is synchronized
with server." might be suitable?
bye,
Sumit
Sure, thanks for comment. Please see updated patch.
ci passed:
http://sssd-ci.duckdns.org/logs/job/11/24/summary.html
> kerr = ERR_CREDS_EXPIRED;
> goto done;
> }
> --
> 2.1.0
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel