On 05/07/2010 07:08 AM, Sumit Bose wrote:
On Thu, May 06, 2010 at 02:10:08PM -0400, Stephen Gallagher wrote:
> On 05/06/2010 09:25 AM, Sumit Bose wrote:
>> On Wed, May 05, 2010 at 09:41:10AM -0400, Stephen Gallagher wrote:
>>> On 05/05/2010 05:02 AM, Sumit Bose wrote
>>>>
>>>> rebased version which should work on top of 'Handle Krb5 password
>>>> expiration warning' is attached.
>>>>
>>>
>>> Nack: please update the sssd.spec to BuildRequires: keyutils-libs-devel
>>> and Requires: keyutils-libs
>>
>> done
>>
>>>
>>> Please reduce krb5_ctx->delayed_online_authentication to
>>> krb5_ctx->deferred_auth. It's much too long and will be difficult to
>>> keep within our 79-character limit.
>>>
>>> Simmilarly, 'struct delayed_online_authentication' should probably
be
>>> 'struct deferred_auth_ctx' (naming it a context makes it less
confusing.
>>> My first impression of the line:
>>> ret = get_uid_table(delayed_online_authentication,&uid_table);
>>> was that you were passing in a function pointer here.
>>
>> done
>>
>>>
>>> In delayed_online_authentication_callback(), reduce the DEBUG message to
>>> level 5.
>>
>> done
>>
>>>
>>> authenticate_stored_users() depends on get_uid_table() returning True,
>>> which will only happen on Linux. We should do a get_uid_table() call in
>>> init_delayed_online_authentication() and skip setting up the online
>>> callback if this feature is unavailable. (With a 0-level DEBUG message
>>> saying that delayed online auth was requested on an unsupported system)
>>> The manpage should also mention that this feature is available only on
>>> Linux.
>>>
>>
>> done
>>
>>>
>>> authenticate_user():
>>> Do we want to revoke the key here? I think we might want to hold onto it
>>> until authenticate_user_done(). That way if it fails (the KDC may be
>>> offline, even though the LDAP provider is online) we can hang onto the
>>> creds and try again the next time we go online.
>>>
>>
>> This is not necessary because the delayed request is handled like an
>> ordinary auth request. If the KDC is offline the request is added to the
>> list of delayed requests again.
>>
>> New version attached.
>>
>> bye,
>> Sumit
>>
>
> Nack
>
> This feature is not working properly. I'll describe my testing steps
> below. (I used IPA for this)
>
> As root on the client, I added
> krb5_store_password_if_offline = true
> to the sssd.conf.
>
> I then made sure there were no users logged in but root and removed
> /tmp/krb5cc*
>
> I turned off my IPA server and sshed into the machine with a user that
> had cached credentials. Offline auth happened as expected.
>
> I then turned my IPA server back on, waited 60s and then performed a
> getent request to get the machine to go online.
>
> I saw in the logs that it went online and performed the deferred kinit.
> However, klist on the logged-in user did not show a tgt. Checking in
> /tmp, I saw two krb5cc* files for the same userid.
>
> It looks like the auto-kinit code is not recognizing an existing ccache.
>
Thanks for catching this, it looks that there was always a ccache
available during my testing. New version attached.
bye,
Sumit
At last, the long-awaited Ack!
This is a great feature.
--
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/