[SSSD] [PATCH] Fixes for automatic ticket renewal

Stephen Gallagher sgallagh at redhat.com
Tue Dec 14 17:21:39 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 12/14/2010 04:17 AM, Sumit Bose wrote:
> Hi,
> 
> I have found some minor issues with automatic ticket renewal while
> testing.
> 
> If random ccache file names are used the name of the ccache file should
> be kept if the user is not logged in, but the TGT is still renewable.
> 
> If a user logs in and out repeatedly and random names are used a new
> hash entry is created for every new ticket. The old entries just eat
> away some memory because the related ccache file is already deleted.
> Using the user name as the hash key solves this, because currently sssd
> (and MIT Kerberos) support one ccache per user.

Nack.

For future compatibility, it would be better if we keyed on the
principal, rather than the username. Then we can support in the future
one user with one ccache per principal.

We're actively working with MIT to try and get them to support multiple
simultaneous TGTs, and I'd really like for us not to have to re-fix this
when that comes through.



- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk0Hp6IACgkQeiVVYja6o6MzJQCgsQ0P+IhTlV8Ldq2gnKGZ8G79
53AAn2v04ALFP+qrJKW3sx3N69CrhDKK
=aaba
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list