[SSSD] [PATCH] Add support for delayed kinit if offline (sssd-1-2 only)

Stephen Gallagher sgallagh at redhat.com
Thu May 6 18:10:08 UTC 2010


On 05/06/2010 09:25 AM, Sumit Bose wrote:
> On Wed, May 05, 2010 at 09:41:10AM -0400, Stephen Gallagher wrote:
>> On 05/05/2010 05:02 AM, Sumit Bose wrote
>>>
>>> rebased version which should work on top of 'Handle Krb5 password
>>> expiration warning' is attached.
>>>
>>
>> Nack: please update the sssd.spec to BuildRequires: keyutils-libs-devel
>> and Requires: keyutils-libs
>
> done
>
>>
>> Please reduce krb5_ctx->delayed_online_authentication to
>> krb5_ctx->deferred_auth. It's much too long and will be difficult to
>> keep within our 79-character limit.
>>
>> Simmilarly, 'struct delayed_online_authentication' should probably be
>> 'struct deferred_auth_ctx' (naming it a context makes it less confusing.
>> My first impression of the line:
>>       ret = get_uid_table(delayed_online_authentication,&uid_table);
>> was that you were passing in a function pointer here.
>
> done
>
>>
>> In delayed_online_authentication_callback(), reduce the DEBUG message to
>> level 5.
>
> done
>
>>
>> authenticate_stored_users() depends on get_uid_table() returning True,
>> which will only happen on Linux. We should do a get_uid_table() call in
>> init_delayed_online_authentication() and skip setting up the online
>> callback if this feature is unavailable. (With a 0-level DEBUG message
>> saying that delayed online auth was requested on an unsupported system)
>> The manpage should also mention that this feature is available only on
>> Linux.
>>
>
> done
>
>>
>> authenticate_user():
>> Do we want to revoke the key here? I think we might want to hold onto it
>> until authenticate_user_done(). That way if it fails (the KDC may be
>> offline, even though the LDAP provider is online) we can hang onto the
>> creds and try again the next time we go online.
>>
>
> This is not necessary because the delayed request is handled like an
> ordinary auth request. If the KDC is offline the request is added to the
> list of delayed requests again.
>
> New version attached.
>
> bye,
> Sumit
>

Nack

This feature is not working properly. I'll describe my testing steps 
below. (I used IPA for this)

As root on the client, I added
krb5_store_password_if_offline = true
to the sssd.conf.

I then made sure there were no users logged in but root and removed 
/tmp/krb5cc*

I turned off my IPA server and sshed into the machine with a user that 
had cached credentials. Offline auth happened as expected.

I then turned my IPA server back on, waited 60s and then performed a 
getent request to get the machine to go online.

I saw in the logs that it went online and performed the deferred kinit. 
However, klist on the logged-in user did not show a tgt. Checking in 
/tmp, I saw two krb5cc* files for the same userid.

It looks like the auto-kinit code is not recognizing an existing ccache.

-- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/



More information about the sssd-devel mailing list