On Wed, 2013-09-25 at 14:04 +0200, Jakub Hrozek wrote:
On Tue, Sep 24, 2013 at 08:53:32AM -0400, Simo Sorce wrote:
> On Tue, 2013-09-24 at 12:59 +0200, Jakub Hrozek wrote:
> > On Fri, Sep 20, 2013 at 01:04:06PM -0400, Simo Sorce wrote:
> > > Addresses #2053 and #2094
> > >
> > > Check old ccaches only if needed, always precreate containing directory
> > > if we are goign to proceed with authentication and always fallback to
> > > old algorithm to check user presence on the system if systemd-login
> > > fails or returns negative result.
> > >
> > > (Patches as agreed on IRC after several discussions)
> > >
> > > All tested and apparently working.
> >
> > Sorry, I didn't have the time to test the first two patches yet, but
I'd
> > like to have the third one pushed asap.
> >
> > So ACK to the third patch. I think it matches what we agreed on IRC --
> > only positive match from logind is now authoritative, negative is only
> > taken into account if checking proc failed.
>
> You really need the first one too. It fixes a bug that causes issues on
> authentication.
>
> Simo.
OK, ACK to the first patch, too. I haven't found any issues with it
(although I must confess I only tested with DIR cache).
But the second patch seems to break offline authentication. Normally,
when a user logs in offline, he is supposed to have an expired TGT so
that it can be renewed once sssd gets online. But with the 2nd patch I'm not
seeing that behaviour:
$ su - tuser(a)ad.example.com
Password:
[tuser@AD.EXAMPLE.COM(a)adclient ~]$ klist
klist: No credentials cache found (ticket cache
DIR::/run/user/1983201105/krb5cc/tkt)
Haven't found what causes this yet, however in the meanwhile attached
find the patch rebased on top of the one for #2071 I just sent to the
other thread.
Simo.
--
Simo Sorce * Red Hat, Inc * New York