[SSSD] [PATCH] Try to renew Kerberos credentials

Stephen Gallagher sgallagh at redhat.com
Mon Dec 7 13:06:07 UTC 2009


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 12/04/2009 05:15 AM, Sumit Bose wrote:
> Hi,
> 
> this patch should fix #299. Before going offline it is checked if GSSAPI
> is used and the TGT is expired.
> 
> bye,
> Sumit
> 

Nack.

In sdap_check_gssapi_reconnect(), I think you should use server_name and
server_principal instead of "service". On first readthrough I was
thinking that this was supposed to be the LDAP service name, and I
thought it was wrong, when really it's the KDC service name.


This is an unsafe use of errno. Please store it. (fprintf or any future
function we use in the DEBUG macro may alter errno):
ret = gethostname(hostname, sizeof(hostname)-1);
if (ret == -1) {
  DEBUG(1, ("gethostname failed [%d][%s].\n", errno, strerror(errno)));
  goto done;
}

I think the DEBUG statement for the client principal name should be a
little lower than level 9. Perhaps 6 or 7. (9 is more or less reserved
for really low-level, high volume messages like the D-BUS dispatches).
If we needed to check this value, that's too noisy a level for it. Same
comment for the TGT end time.



- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAksc/b8ACgkQeiVVYja6o6Pz5QCeLiD560xmCy9d4dRDMiSwvsWO
KdEAoIWtDejWw6FHG36bjNsNcMYg/ZV9
=o1bp
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list