[SSSD] krb5 ticket renewal via gnome-screensaver not working
Simo Sorce
ssorce at redhat.com
Thu Nov 12 00:03:49 UTC 2009
On Wed, 2009-11-11 at 17:27 -0500, Brian J. Murrell wrote:
> > If
> > you want to renew the TGT with every authentication you have to use
> a
> > per-user unique ccache file, e.g. FILE:%d/krb5cc_%U.
>
> I don't think so. I think even a per-login-session ccache file that
> will be created by a gnome session should work if sssd is correctly
> renewing the TGT, because the same ccache file that was created by gdm
> should be updated by gnome-screensaver.
I have tested this yesterday (with git master), if you set FILE:%
d/krb5cc_%U sssd will happily refresh the crdentials at screen unlock.
Unfortunately the code and the docs disagree on the parm name but we
already have a patch on the list to fix this.
> > We are currently discussing how to handle renewals in a more general
> way
> > so that it would be possible to renew FILE:%d/krb5cc_%U_XXXXXX-style
> > files too.
>
> I really don't see why these FILE:%d/krb5cc_%U_XXXXXX-style files
> would
> not renew in the context of a gnome session.
Because sssd is generating a new one each time for now (yes it's a bug).
> On the other hand, I don't really see the purpose of FILE:%d/krb5cc_%
> U_XXXXXX-style files where every login session is a new ccache.
>
> Can anyone share a use-case where this is needed?
Well I think people were worried that using a predictable name (krb5cc_%
U) could be used by malicious user to mount symlink race attacks. We
have just copied what is already an available scheme for the krb5
libraries, although we might switch to a default of FILE:%d/krb5cc_%U
for the 1.0 release to avoid issues.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
More information about the sssd-devel
mailing list