[SSSD] How to handle kdcinfo when offline

Stephen Gallagher sgallagh at redhat.com
Tue May 11 20:19:27 UTC 2010


Simo and I had a long discussion on IRC today regarding how to handle 
the kdcinfo and kpasswdinfo files for the Kerberos locator plugin.

The basic problem is this: our recent changes made it so that when we 
shut down the SSSD, we remove the kdcinfo files. When we start back up, 
we write a new kdcinfo file with a correct IP address if available, or 
with a fake one if we're offline.

This is causing problems with non-SSSD kerberized services. Prior to 
these changes, we always left the kdcinfo file around, so when we went 
online (such as connecting to a VPN), the locator plugin would already 
have the old IP saved, so we would be able to hand it off and continue 
to work.

Now, we continue to return "Can't contact KDC" until the SSSD performs 
an online kinit. This may not happen immediately (or for a very long 
time). And until that happens, kerberized servers and applications won't 
work.

After much discussion, Simo and I have come up with the following 
approach: When the SSSD is offline (mark_offline() is called) we should 
remove the kdcinfo and kpasswdinfo files. In the locator plugin, if 
those files are not present, we should return the appropriate error code 
to pass the handling on to the krb5.conf.

We will then allow the configuration in krb5.conf to handle requests 
until we go online, at which time we will write out the kdcinfo files 
and handle it ourselves.

This will probably require the following changes:
1) Enable providers to register a callback for "mark_offline()"
2) Create a callback for the kerberos provider to remove kdcinfo and 
kpasswdinfo files upon going offline (and also when shutting down)
3) Modify the locator plugin to return "not handled" if the kdcinfo file 
is missing.

-- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/



More information about the sssd-devel mailing list