[SSSD] [PATCH] Support DIR: credential caches

Stephen Gallagher sgallagh at redhat.com
Wed Jun 13 15:12:08 UTC 2012


Sending the review in chunks.

On Wed, 2012-06-13 at 15:48 +0200, Jakub Hrozek wrote:
> [PATCH 01/11] Two small krb5_child fixes
> ssia
> 

Nack. You only fixed the errno overwrite in one of the two debug
messages you changed.

> [PATCH 02/11] Provide more debugging in krb5_child and ldap_child
> I started this patch before Nick did, maybe it would still be useful, at
> least the parts that get rid of level-9 DEBUG messages.
> 

Nack.

Can we change the debug log message "Created ccache file:" to just
"Created ccache:"? Since we're now printing the whole CCNAME, complete
with type.

Speling misteak (it was there before, but we should fix it while we're
touching the code:
"successfull" should be "successful" in changepw_child()

> [PATCH 03/11] Allow redefining the KRB5_CHILD path
> The krb5-child-test will want to run the child from the build directory.
> 

Ack

> [PATCH 04/11] Split parse_krb5_child_response so it can be reused
> krb5-child-test will be another consumer. It also makes the code more
> readable by splitting a huge function.
> 

Ack

> [PATCH 05/11] Add a krb5_child test tool
> https://fedorahosted.org/sssd/ticket/1127
> 

Nack

Typo in help: secods -> seconds.

Typo in DEBUG: unkown -> unknown


> [PATCH 06/11] Residual util functions
> Kerberos credential caches can be specified by TYPE:RESIDUAL. This pa
> tch adds a couple of utilities to support parsing if ccache locations,
> checking types etc.
> 
> [PATCH 07/11] Handle trailing slash in the ccname template
> With the DIR cache support, it's perfectly legal to specify a ccname
> directory that ends with a slash. The create_dir function did not han dle
> that situation correctly. The unit test is included in the DIR: cache
> patch, because it uses the cc_dir_create() function.
> 
> [PATCH 08/11] Add a credential cache back end structure
> To be able to add support for new credential cache types easily, this
> patch creates a new structure sss_krb5_cc_be that defines common with
> a credential cache, such as create, check if used or remove.
> 
> [PATCH 09/11] Add support for storing credential caches in the DIR: back end
> https://fedorahosted.org/sssd/ticket/974
> 
> Please note that only the TGTs acquired by the krb5_child have changed,
> the ldap_child still puts its ccache into /var/lib/sss/db.
> 
> The cc_dir_remove() function is a little odd, I tried to use the krb5
> API directly, but I think I found a bug in libkrb5. For a subsidiary
> cache that does not exist (DIR::/no/such/path), the following code would
> segfault:
> 
>     krb5_cc_resolve(context, location, &ccache); // returns EOK
>     krberr = krb5_cc_destroy(context, ccache);   // KRB5_FCC_NOFILE
>     if (krberr) {
>         if (ccache) krb5_cc_close(context, ccache); // SIGSEGV
>     }
> 
> [PATCH 10/11] Use Kerberos context in KRB5_DEBUG
> Passing Kerberos context to sss_krb5_get_error_message will allow us to
> get better error messages. This patch technically belong earlier, but
> rebasing would be hard at this point.
> 
> [PATCH 11/11] Switch Kerberos cache default to DIR
> Just switches the defaults.
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120613/369b176a/attachment.sig>


More information about the sssd-devel mailing list