[SSSD] [PATCH 2/2] Do not call krb5_child when changing passwords and provider went offline

Stephen Gallagher sgallagh at redhat.com
Thu Jan 5 16:33:26 UTC 2012


On Thu, 2012-01-05 at 11:26 +0100, Jakub Hrozek wrote:
> On Wed, Jan 04, 2012 at 08:32:07PM -0500, Stephen Gallagher wrote:
> > On Wed, 2012-01-04 at 22:18 +0100, Jakub Hrozek wrote:
> > > https://fedorahosted.org/sssd/ticket/1131
> > > 
> > > If the SSSD back end goes offline during Kerberos auth, the back end calls
> > > the child process for the second time in order to create an expired TGT.
> > > 
> > > In case the KDC server is used for KPASSWD operation, but the Kerberos
> > > library returns that the KDC is not available during chpass, SSSD would
> > > still attempt to call the krb5_child process for the second time. The
> > > child would still attempt to changepw, which would fail, then SSSD would
> > > go offline again and call the child again etc. The back end would go
> > > into infinite loop.
> > > 
> > > A simple test case is to create an IPA user with an expired password,
> > > shut down the ipa_kpasswd process and try to log in.
> > 
> > Nack (nitpick).
> > 
> > Please use the appropriate DEBUG level macros.
> 
> Thanks, new patch is attached.

Ack.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120105/7e092ed3/attachment.sig>


More information about the sssd-devel mailing list