On Fri, Mar 20, 2015 at 12:04:08PM +0100, Sumit Bose wrote:
On Fri, Mar 20, 2015 at 11:52:03AM +0100, Pavel Reichl wrote:
>
>
> On 03/20/2015 11:26 AM, Sumit Bose wrote:
> >On Thu, Mar 19, 2015 at 05:28:40PM +0100, Pavel Reichl wrote:
> >>While testing some patches I could not authenticate as IPA user, problem
was
> >>that there was time skew about 30 minutes between IPA server and IPA
client.
> >>Attached patch should provide clear hint about this possibility.
> >>
> >>Thanks.
> >> From f84d1e19da7b79cd51e541033d09ef72dccb9505 Mon Sep 17 00:00:00 2001
> >>From: Pavel Reichl <preichl(a)redhat.com>
> >>Date: Thu, 19 Mar 2015 11:16:53 -0400
> >>Subject: [PATCH] KRB5: add debug hint
> >>
> >>---
> >> src/providers/krb5/krb5_child.c | 2 ++
> >> 1 file changed, 2 insertions(+)
> >>
> >>diff --git a/src/providers/krb5/krb5_child.c
b/src/providers/krb5/krb5_child.c
> >>index
8fb2e6b2f5565f6594e03b9c45f0ab50e9eed17e..03245bdfce6b44803d344eb5d1e702b5e5bb161f 100644
> >>--- a/src/providers/krb5/krb5_child.c
> >>+++ b/src/providers/krb5/krb5_child.c
> >>@@ -1896,6 +1896,8 @@ static krb5_error_code check_fast_ccache(TALLOC_CTX
*mem_ctx,
> >> if (tgtt.endtime < time(NULL)) {
> >> DEBUG(SSSDBG_OP_FAILURE,
> >> "Valid FAST TGT not found after attempting to renew
it\n");
> >>+ DEBUG(SSSDBG_TRACE_FUNC,
> >>+ "Please check that time is synchronized with
server.\n");
> >I think the hint is good at this point but I would suggest to just merge
> >it with the previous message. Since the expiriation time is checked
> >explicitly here for the renewed ticket something like "FAST TGT was
> >renewed but is already expired, please check that time is synchronized
> >with server." might be suitable?
> >
> >bye,
> >Sumit
> Sure, thanks for comment. Please see updated patch.
ACK
bye,
Sumit
* master: 2bb92b969abc805be95f58ab5aafe9cde09e2238