[SSSD] LDAP connection tracking, sharing and fail-over retry framework

Eugene Indenbom eindenbom at gmail.com
Thu Jun 17 12:39:44 UTC 2010


On 06/16/2010 06:47 PM, Simo Sorce wrote:
> On Wed, 16 Jun 2010 10:43:08 +0400
> Eugene Indenbom<eindenbom at gmail.com>  wrote:
>
>    
>> 0001-GSSAPI-ticket-expiry-time-is-returned-from-ldap_chil.patch
>>           A small utility patch saving GSSAPI ticket expiry time in
>> sdap_handle for future use.
>>      
> Just an FYI, in a recent meeting with the MIT krb5 folks, it was
> finally decided to stop breaking GSSAPI sealed connections when the
> original ticket expires. (Heimdal never did that either).
>    
That sounds really strange for me. Although it is OK to keep the 
connection on CLIENT side after ticket expiration, the connection should 
be broken on the SERVER side as permission to use the SERVICE granted by 
kerberos TGS is expired and ticket must be renewed before the SERVICE is 
resumed.

Do you have any comments or explanation on the issue? Is there any forum 
or mailing list where this problem is discussed?
> This means that in future we will not need to check for this expiration
> time because the connection will not drop.
> Current libraries of course still do that, so we may have to keep doing
> something about this problem for people using older MIT libraries.
>
>    
As you can see from previous e-mails and related tickets, handling of 
GSSAPI ticket expiration is only one (and from my point of view least 
important) item, I am trying to resolve by submitted patches.
> But I wonder if we should just use some fallback mechanisms in that case
> instead of changing the interfaces to handle something that will stop
> being a problem soon.
>
> Up for discussion.
>
> Simo.
>
>    




More information about the sssd-devel mailing list