[SSSD] [PATCH] Create kdcinfo and kpasswdinfo file at startup

Sumit Bose sbose at redhat.com
Mon May 10 10:56:37 UTC 2010


On Sun, May 09, 2010 at 02:56:07PM -0400, Simo Sorce wrote:
> On Fri, 7 May 2010 17:23:57 +0200
> Sumit Bose <sbose at redhat.com> wrote:
> 
> > On Fri, May 07, 2010 at 11:00:34AM -0400, Stephen Gallagher wrote:
> > > On 05/07/2010 09:34 AM, Sumit Bose wrote:  
> > > > Hi,
> > > >
> > > > this patch should solve #470 by calling be_resolve_server_send()
> > > > during startup.
> > > >  
> > > 
> > > 
> > > Nack. As discussed off-list, we need to write a kdcinfo even when
> > > we're offline at startup, so that services trying to get service
> > > tickets will receive "Cannot contact any KDC for realm
> > > 'EXAMPLE.COM' while getting initial credentials" instead of "Can't
> > > locate any KDC for realm 'EXAMPLE.COM'" Presumably network services
> > > will handle for themselves retrying to get the service ticket at a
> > > future time if it's only unavailable, but if it can't find the KDC
> > > at all, it may simply refuse to start.  
> > 
> > New version attached.
> 
> Sorry, I am not really sure this is a good idea. How do we know that
> this faulty address is not going to be cached somewhere and will end up
> making the app fail ? Do we have assurances it is never cached in
> libkrb5 ?

I think kibkrb5 will not cache the address otherwise having locators
plugins wouldn't make much sense. Nevertheless I maybe have a better
idea to solve this, because it looks that libkrb5 will return the error
code of the locator plugin unmodified. So if we let the locator plugin
return the error code for "Cannot contact any KDC for realm 'EXAMPLE.COM'"
it should work without returning a random address. I'll check if this
really works and on success send a new patch.

bye,
Sumit

> 
> Simo.
> 
> -- 
> Simo Sorce * Red Hat, Inc * New York
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel



More information about the sssd-devel mailing list