[SSSD] Ticket renewal

Stephen Gallagher sgallagh at redhat.com
Wed Jan 6 12:21:52 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 01/05/2010 06:25 PM, Dmitri Pal wrote:
> Hi,
> 
> I thought that ticket renewal was fixed in the version I have.
> My yum info is blow at the bottom.
> 
> Issue 1) I have been on line on VPN for many hours today. The screen
> locked and unlocked many times.
> The klist gives:
> 
> [dpal at dpal common]$ klist
> Ticket cache: FILE:/tmp/krb5cc_12785_JvrvLj
> Default principal: dpal at REDHAT.COM
> 
> Valid starting     Expires            Service principal
> 12/31/69 19:00:00  12/31/69 19:00:00  krbtgt/REDHAT.COM at REDHAT.COM
> 
> 
> Kerberos 4 ticket cache: /tmp/tkt12785
> klist: You have no tickets cached
> [dpal at dpal common]$ ls /tmp/krb*
> /tmp/krb5cc_12785  /tmp/krb5cc_12785_JvrvLj
> [dpal at dpal common]$ klist /tmp/krb5cc_12785
> Ticket cache: FILE:/tmp/krb5cc_12785
> Default principal: dpal at REDHAT.COM
> 
> Valid starting     Expires            Service principal
> 12/03/09 09:01:03  12/03/09 19:01:00  krbtgt/REDHAT.COM at REDHAT.COM
> [dpal at dpal common]$
> 
> I would expect to have a valid ticket. I thought the issue was fixed
> before 1.0.0 which I have. May be I am mistaken.

I am currently experiencing the same issue on my machine. Looking at the
logs, I am seeing
(Wed Jan  6 07:15:19 2010) [sssd[nss]] [sss_dp_get_reply] (4): Got reply
(1, 11, Fast reply - offline) from Data Provider
(Wed Jan  6 07:15:19 2010) [sssd[nss]] [nss_cmd_getpwnam_dp_callback]
(2): Unable to get information from Data Provider
Error: 1, 11, Fast reply - offline
Will try to return what we have in cache

This suggests that even though I can reach the LDAP server manually, for
some reason we are not marking it as being back online. I will
investigate further.

To be clear: the problem is NOT with Kerberos. We are not even
attempting to perform online auth when we are in this situation.
Restarting the SSSD while on the VPN should put you back online, and
ticket renewals should work from then on.

This is a problem with online/offline detection, possibly in the
failover code or possibly in the "fast reply" code. (I haven't narrowed
it down yet)

> 
> Issue 2) Why the new package is 1.2 M and the old is 4.1M. This seems
> like a significant change. Are we missing anything?

Dmitri, what you're seeing is the installed space (uncompressed) vs. the
size of the RPM  (which is compressed). If you were to install the newer
package, you would see that 'yum info' reports it as being 4M then. So
there's no issue here.

You can verify this with any other package on your system that has an
available update.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAktEgFoACgkQeiVVYja6o6OylgCgn2vT9zmSf+zUJixKvHyn7wLk
YjYAoK3GKIvvwZGjbDJegSzbJH/+zbNn
=WoW8
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list