[SSSD] [PATCHES] Fix krb5 ticket renewal

Jakub Hrozek jhrozek at redhat.com
Mon Jun 24 16:22:35 UTC 2013


On Mon, Jun 24, 2013 at 04:28:10PM +0100, David Woodhouse wrote:
> On Mon, 2013-06-24 at 17:01 +0200, Jakub Hrozek wrote:
> > On Mon, Jun 24, 2013 at 04:59:33PM +0200, Jakub Hrozek wrote:
> > > On Mon, Jun 24, 2013 at 04:23:46PM +0200, Sumit Bose wrote:
> > > > Hi,
> > > > 
> > > > David Woodhouse identified an issue with Kerberos ticket renewal.
> > > > Attached two patches fix two issues related to the authtok refactoring
> > > > which make renewal for me working again.
> > > > 
> > > > bye,
> > > > Sumit
> > > 
> > > Works for me, too. Ack.
> > 
> > Pushed both to master.
> 
> An improvement, but still not working.
> 
> Firstly I have to revert commit 3438815242464a963c0d3a70f16579723a20b52d
> ("LDAP: Retry SID search based on result of LDAP search, not the return
> code") because otherwise I can't log in at all (I sent logs in private
> mail).
> 

The login failure is not related to the commit per se, the commit is
actually correct and gets you further in the login process, but then you
hit the old bug with the referral. I'm still not quite sure why SSSD
decided to contact LDAP there and not the GC.

> Then it does actually seem to be *trying* to renew, but I get the
> following:
> 

[snip]

> FWIW running 'kinit -R' manually does work.

As discussed on #sssd, this is a bug in how we renew enterprise
principals.



More information about the sssd-devel mailing list