[SSSD] [PATCH] Fix kinit after password change

Sumit Bose sbose at redhat.com
Tue Mar 23 15:41:02 UTC 2010


On Tue, Mar 23, 2010 at 03:36:43PM +0100, Sumit Bose wrote:
> Hi,
> 
> this patch should fix #433 'Changing password with Kerberos succeeds,
> but still returns an error message'
> 
> bye,
> Sumit

With a suggestion from Nalin I came to a much simpler and more flexible
solution.

New version attached.

bye,
Sumit
-------------- next part --------------
From ce1386d9f0a48ebba76208b819a6430eb22faf9a Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Tue, 23 Mar 2010 16:34:31 +0100
Subject: [PATCH] Fix kinit after password change

In an environment with slave KDCs and a central server where password
changes are allowed the request for a new TGT immediately after the
password change should be made against this server, because the slave
server might not know the new password.

To achieve this the Kerberos localtor plugin now returns the address of
the kpasswd server as master_kdc.
---
 src/krb5_plugin/sssd_krb5_locator_plugin.c |    8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/krb5_plugin/sssd_krb5_locator_plugin.c b/src/krb5_plugin/sssd_krb5_locator_plugin.c
index 626960a..153145b 100644
--- a/src/krb5_plugin/sssd_krb5_locator_plugin.c
+++ b/src/krb5_plugin/sssd_krb5_locator_plugin.c
@@ -289,7 +289,8 @@ krb5_error_code sssd_krb5_locator_lookup(void *private_data,
             return KRB5_PLUGIN_NO_HANDLE;
         }
 
-        if (svc == locate_service_kadmin || svc == locate_service_kpasswd) {
+        if (svc == locate_service_kadmin || svc == locate_service_kpasswd ||
+            svc == locate_service_master_kdc) {
             ret = get_krb5info(realm, ctx, locate_service_kpasswd);
             if (ret != EOK) {
                 PLUGIN_DEBUG(("reading kpasswd address failed, "
@@ -307,10 +308,13 @@ krb5_error_code sssd_krb5_locator_lookup(void *private_data,
 
     switch (svc) {
         case locate_service_kdc:
-        case locate_service_master_kdc:
             addr = ctx->kdc_addr;
             port = ctx->kdc_port ? ctx->kdc_port : DEFAULT_KERBEROS_PORT;
             break;
+        case locate_service_master_kdc:
+            addr = ctx->kpasswd_addr;
+            port = DEFAULT_KERBEROS_PORT;
+            break;
         case locate_service_kadmin:
             addr = ctx->kpasswd_addr;
             port = DEFAULT_KADMIN_PORT;
-- 
1.6.6.1



More information about the sssd-devel mailing list