sumit-bose commented on a pull request
On Tue, Sep 06, 2016 at 05:37:14AM -0700, Pavel Březina wrote:
On 09/06/2016 02:21 PM, Jakub Hrozek wrote:
> On Tue, Sep 06, 2016 at 05:10:07AM -0700, Pavel Březina wrote:
> > On 09/06/2016 01:51 PM, Jakub Hrozek wrote:
> > > Thanks for the ack, I would also like to ask @sumit-bose
> > > <https://github.com/sumit-bose>
if he agrees with the change.
> > Btw since clock skew is not fatal anymore, is it possible for us to
> > actually perform online authentication?
> The TGT times are generated on the server and the error usually happens
> only when the client attempts to use the TGT for something like FAST
> tunnel establishment or TGT validation. See Sumit's reply here:
> (that's why I wanted him to confirm this is a good idea)
AFAIK kinit's magic applies clock skew to the timestamp in the ticket
and compares times within the client's range. I'm just asking if there
is something similar we can do in SSSD:
iirc this magic is applied to the timestamps used in the "default"
pre-authentication method where encrypted timestamps are send around.
This does not related to the timestamps in the tickets.
You are receiving this because you were mentioned.
Reply to this email directly or view it on GitHub:
See the full comment at https://github.com/SSSD/sssd/pull/15#issuecomment-244943023