[SSSD] krb5 ticket renewal via gnome-screensaver not working

Simo Sorce ssorce at redhat.com
Thu Nov 12 00:03:49 UTC 2009


On Wed, 2009-11-11 at 17:27 -0500, Brian J. Murrell wrote:
> > If
> > you want to renew the TGT with every authentication you have to use
> a
> > per-user unique ccache file, e.g. FILE:%d/krb5cc_%U.
> 
> I don't think so.  I think even a per-login-session ccache file that
> will be created by a gnome session should work if sssd is correctly
> renewing the TGT, because the same ccache file that was created by gdm
> should be updated by gnome-screensaver.

I have tested this yesterday (with git master), if you set FILE:%
d/krb5cc_%U sssd will happily refresh the crdentials at screen unlock.
Unfortunately the code and the docs disagree on the parm name but we
already have a patch on the list to fix this.

> > We are currently discussing how to handle renewals in a more general
> way
> > so that it would be possible to renew FILE:%d/krb5cc_%U_XXXXXX-style
> > files too.
> 
> I really don't see why these FILE:%d/krb5cc_%U_XXXXXX-style files
> would
> not renew in the context of a gnome session.

Because sssd is generating a new one each time for now (yes it's a bug).

> On the other hand, I don't really see the purpose of FILE:%d/krb5cc_%
> U_XXXXXX-style files where every login session is a new ccache.
> 
> Can anyone share a use-case where this is needed?

Well I think people were worried that using a predictable name (krb5cc_%
U) could be used by malicious user to mount symlink race attacks. We
have just copied what is already an available scheme for the krb5
libraries, although we might switch to a default of FILE:%d/krb5cc_%U
for the 1.0 release to avoid issues.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list