URL:
https://github.com/SSSD/sssd/pull/5450
Title: #5450: kcm: add support for kerberos tgt renewals
pbrezina commented:
"""
Sorry, it still does not work correctly. Right now you don't continue with next user
if you did not find the current. You want:
```diff
diff --git a/src/responder/kcm/kcmsrv_ccache_secdb.c
b/src/responder/kcm/kcmsrv_ccache_secdb.c
index 7591c5687..14315e01b 100644
--- a/src/responder/kcm/kcmsrv_ccache_secdb.c
+++ b/src/responder/kcm/kcmsrv_ccache_secdb.c
@@ -707,7 +707,7 @@ static errno_t renew_check_ccaches(struct krb5_ctx *krb5_ctx,
struct passwd *pwd;
errno_t ret;
- cli_cred = talloc_zero(ev, struct cli_creds);
+ cli_cred = talloc_zero(NULL, struct cli_creds);
if (cli_cred == NULL) {
return ENOMEM;
}
@@ -716,11 +716,10 @@ static errno_t renew_check_ccaches(struct krb5_ctx *krb5_ctx,
for (int i = 0; i < uid_count; i++) {
pwd = getpwuid(uids[i]);
if (pwd == NULL) {
- talloc_zfree(cli_cred);
DEBUG(SSSDBG_OP_FAILURE, "Failed to get pwd entry for [%d]\n",
uids[i]);
/* Not fatal */
- return EOK;
+ continue;
}
cli_cred->ucred.uid = pwd->pw_uid;
@@ -728,16 +727,14 @@ static errno_t renew_check_ccaches(struct krb5_ctx *krb5_ctx,
ret = secdb_container_url_req(state, sctx, cli_cred, &sreq);
if (ret != EOK) {
- talloc_zfree(cli_cred);
- return EINVAL;
+ goto done;
}
ret = sss_sec_list(state, sreq, &keys, &nkeys);
if (ret == ENOENT) {
nkeys = 0;
} else if (ret != EOK) {
- talloc_zfree(cli_cred);
- return EINVAL;
+ goto done;
}
DEBUG(SSSDBG_TRACE_INTERNAL, "Found [%zu] ccaches under uid [%u]\n",
nkeys, uids[i]);
@@ -746,14 +743,16 @@ static errno_t renew_check_ccaches(struct krb5_ctx *krb5_ctx,
for (size_t j = 0; j < nkeys; j++) {
ret = renew_check_creds(krb5_ctx, state, sctx, cli_cred, keys[j]);
if (ret != EOK && ret != ENOENT) {
- talloc_zfree(cli_cred);
DEBUG(SSSDBG_OP_FAILURE, "Failed to check credentials\n");
- return EINVAL;
+ goto done;
}
}
}
- return EOK;
+done:
+ talloc_free(cli_cred);
+
+ return ret;
}
static errno_t ccdb_secdb_renew_init(struct krb5_ctx *krb5_ctx,
```
Also what do we need the renew hash table for? I don't see where you take advantage of
it? You always call `kcm_ccdb_renew_init` from `kcm_renew_tgt_timer_handler` so you always
iterate over all cached credentials before you attempt to renew it. What was the intention
here?
"""
See the full comment at
https://github.com/SSSD/sssd/pull/5450#issuecomment-811141452