[SSSD] [PATCH 2/2] Do not call krb5_child when changing passwords and provider went offline

Stephen Gallagher sgallagh at redhat.com
Thu Jan 5 01:32:07 UTC 2012


On Wed, 2012-01-04 at 22:18 +0100, Jakub Hrozek wrote:
> https://fedorahosted.org/sssd/ticket/1131
> 
> If the SSSD back end goes offline during Kerberos auth, the back end calls
> the child process for the second time in order to create an expired TGT.
> 
> In case the KDC server is used for KPASSWD operation, but the Kerberos
> library returns that the KDC is not available during chpass, SSSD would
> still attempt to call the krb5_child process for the second time. The
> child would still attempt to changepw, which would fail, then SSSD would
> go offline again and call the child again etc. The back end would go
> into infinite loop.
> 
> A simple test case is to create an IPA user with an expired password,
> shut down the ipa_kpasswd process and try to log in.

Nack (nitpick).

Please use the appropriate DEBUG level macros.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120104/212bf22f/attachment.sig>


More information about the sssd-devel mailing list