[SSSD] [PATCH] Add support for delayed kinit if offline (sssd-1-2 only)

Stephen Gallagher sgallagh at redhat.com
Fri May 7 12:45:52 UTC 2010


On 05/07/2010 07:08 AM, Sumit Bose wrote:
> On Thu, May 06, 2010 at 02:10:08PM -0400, Stephen Gallagher wrote:
>> On 05/06/2010 09:25 AM, Sumit Bose wrote:
>>> On Wed, May 05, 2010 at 09:41:10AM -0400, Stephen Gallagher wrote:
>>>> On 05/05/2010 05:02 AM, Sumit Bose wrote
>>>>>
>>>>> rebased version which should work on top of 'Handle Krb5 password
>>>>> expiration warning' is attached.
>>>>>
>>>>
>>>> Nack: please update the sssd.spec to BuildRequires: keyutils-libs-devel
>>>> and Requires: keyutils-libs
>>>
>>> done
>>>
>>>>
>>>> Please reduce krb5_ctx->delayed_online_authentication to
>>>> krb5_ctx->deferred_auth. It's much too long and will be difficult to
>>>> keep within our 79-character limit.
>>>>
>>>> Simmilarly, 'struct delayed_online_authentication' should probably be
>>>> 'struct deferred_auth_ctx' (naming it a context makes it less confusing.
>>>> My first impression of the line:
>>>>        ret = get_uid_table(delayed_online_authentication,&uid_table);
>>>> was that you were passing in a function pointer here.
>>>
>>> done
>>>
>>>>
>>>> In delayed_online_authentication_callback(), reduce the DEBUG message to
>>>> level 5.
>>>
>>> done
>>>
>>>>
>>>> authenticate_stored_users() depends on get_uid_table() returning True,
>>>> which will only happen on Linux. We should do a get_uid_table() call in
>>>> init_delayed_online_authentication() and skip setting up the online
>>>> callback if this feature is unavailable. (With a 0-level DEBUG message
>>>> saying that delayed online auth was requested on an unsupported system)
>>>> The manpage should also mention that this feature is available only on
>>>> Linux.
>>>>
>>>
>>> done
>>>
>>>>
>>>> authenticate_user():
>>>> Do we want to revoke the key here? I think we might want to hold onto it
>>>> until authenticate_user_done(). That way if it fails (the KDC may be
>>>> offline, even though the LDAP provider is online) we can hang onto the
>>>> creds and try again the next time we go online.
>>>>
>>>
>>> This is not necessary because the delayed request is handled like an
>>> ordinary auth request. If the KDC is offline the request is added to the
>>> list of delayed requests again.
>>>
>>> New version attached.
>>>
>>> bye,
>>> Sumit
>>>
>>
>> Nack
>>
>> This feature is not working properly. I'll describe my testing steps
>> below. (I used IPA for this)
>>
>> As root on the client, I added
>> krb5_store_password_if_offline = true
>> to the sssd.conf.
>>
>> I then made sure there were no users logged in but root and removed
>> /tmp/krb5cc*
>>
>> I turned off my IPA server and sshed into the machine with a user that
>> had cached credentials. Offline auth happened as expected.
>>
>> I then turned my IPA server back on, waited 60s and then performed a
>> getent request to get the machine to go online.
>>
>> I saw in the logs that it went online and performed the deferred kinit.
>> However, klist on the logged-in user did not show a tgt. Checking in
>> /tmp, I saw two krb5cc* files for the same userid.
>>
>> It looks like the auto-kinit code is not recognizing an existing ccache.
>>
>
> Thanks for catching this, it looks that there was always a ccache
> available during my testing. New version attached.
>
> bye,
> Sumit
>

At last, the long-awaited Ack!

This is a great feature.

-- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/



More information about the sssd-devel mailing list