[SSSD] LDAP connection tracking, sharing and fail-over retry framework

Simo Sorce ssorce at redhat.com
Wed Jun 16 14:47:47 UTC 2010


On Wed, 16 Jun 2010 10:43:08 +0400
Eugene Indenbom <eindenbom at gmail.com> wrote:

> 0001-GSSAPI-ticket-expiry-time-is-returned-from-ldap_chil.patch
>          A small utility patch saving GSSAPI ticket expiry time in 
> sdap_handle for future use.

Just an FYI, in a recent meeting with the MIT krb5 folks, it was
finally decided to stop breaking GSSAPI sealed connections when the
original ticket expires. (Heimdal never did that either).

This means that in future we will not need to check for this expiration
time because the connection will not drop.
Current libraries of course still do that, so we may have to keep doing
something about this problem for people using older MIT libraries.

But I wonder if we should just use some fallback mechanisms in that case
instead of changing the interfaces to handle something that will stop
being a problem soon.

Up for discussion.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York



More information about the sssd-devel mailing list