[Bug 187485] Doesn't seem to renew TGT after it has expired
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.
https://bugzilla.redhat.com/show_bug.cgi?id=187485
--- Comment #24 from Bojan Smojver <bojan(a)rexursive.com> 2009-06-23 21:51:47 EDT ---
Here is a bit of code from gnome-screensaver (src/gs-auth-pam.c):
----------------------
/* Each time we successfully authenticate, refresh credentials,
for Kerberos/AFS/DCE/etc. If this fails, just ignore that
failure and blunder along; it shouldn't matter.
Note: this used to be PAM_REFRESH_CRED instead of
PAM_REINITIALIZE_CRED, but Jason Heiss <jheiss(a)ee.washington.edu>
says that the Linux PAM library ignores that one, and only refreshes
credentials when using PAM_REINITIALIZE_CRED.
*/
status2 = pam_setcred (pam_handle, PAM_REINITIALIZE_CRED);
if (gs_auth_get_verbose ()) {
g_message (" pam_setcred (...) ==> %d (%s)",
status2,
PAM_STRERROR (pam_handle, status2));
}
----------------------
Not sure if the fact that we don't care about credentials being refreshed above
matters or not.
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
14 years, 11 months
[Bug 187485] Doesn't seem to renew TGT after it has expired
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.
https://bugzilla.redhat.com/show_bug.cgi?id=187485
--- Comment #23 from Colin Simpson <csimpson(a)csl.co.uk> 2009-06-23 10:05:22 EDT ---
The bug in gnome-screensaver was fixed in RH in my bug #187341. However that
bug does appear to be again present in later Fedora distro's, I've just tried
F11 and the gnome-screensaver neither renews an expired TGT, renews a current
TGT or renews a nonexistent TGT. Even though it takes my Kerberos password to
unlock the screen saver.
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
14 years, 11 months
[Bug 187485] Doesn't seem to renew TGT after it has expired
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.
https://bugzilla.redhat.com/show_bug.cgi?id=187485
--- Comment #20 from Bojan Smojver <bojan(a)rexursive.com> 2009-06-23 07:29:52 EDT ---
Regarding comment #18:
> still don't know why gnome-screen saver's password dialog doesn't renew the TGT, given that you are giving it a password that is check in Kerberos
Gnome screensaver is relying on PAM for authentication. Whatever pam_krb5 does,
that is what happens. Try this:
kinit -l 10s -r 10s
In 10 seconds, your ticket will expire. Do:
tail -f /var/log/secure
In a terminal. Also, watch the tickets with:
watch klist 2>/dev/null
Now, lock the screen. Unlock and you'll see messages like this in secure log:
Jun 23 21:23:08 machine gnome-screensaver-dialog: pam_krb5[27056]:
authentication succeeds for 'bojan' (bojan(a)REALM.COM)
However, the ticket times will not move (ie. the ticket will not be reissued).
So, this is something that pam_krb5 does or doesn't do, I think. Maybe PAM
folks should change something?
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
14 years, 11 months
[Bug 187485] Doesn't seem to renew TGT after it has expired
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.
https://bugzilla.redhat.com/show_bug.cgi?id=187485
Petter Urkedal <urkedal(a)nbi.dk> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |urkedal(a)nbi.dk
--- Comment #19 from Petter Urkedal <urkedal(a)nbi.dk> 2009-06-23 04:51:18 EDT ---
(In reply to comment #18)
> One minor wrinkle I noticed was if you leave the password dialog up, it seems
> to prevent the screen saver running (gnome-screensaver). I presume as it's
> grabbed the keyboard, there may not be a good way around that. (still don't
> know why gnome-screen saver's password dialog doesn't renew the TGT, given that
> you are giving it a password that is check in Kerberos)
Assuming the TGT renewal works in gnome-screensaver (which it does for me on
EL5), I think the ideal behaviour here is that krb5-auth-dialog closes its
window when the screen saver triggers, and that it doesn't open any windows
as long as the screen saver is active.
This (different) fix from Ubuntu may be of interest:
https://bugs.launchpad.net/ubuntu/+source/krb5-auth-dialog/+bug/73550
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
14 years, 11 months