[SSSD] [PATCH] krb5: do not use enterprise principals for renewals (was: [PATCHES] Fix krb5 ticket renewal)
Sumit Bose
sbose at redhat.com
Tue Jun 25 09:25:32 UTC 2013
On Mon, Jun 24, 2013 at 06:22:35PM +0200, Jakub Hrozek wrote:
> On Mon, Jun 24, 2013 at 04:28:10PM +0100, David Woodhouse wrote:
> > On Mon, 2013-06-24 at 17:01 +0200, Jakub Hrozek wrote:
> > > On Mon, Jun 24, 2013 at 04:59:33PM +0200, Jakub Hrozek wrote:
> > > > On Mon, Jun 24, 2013 at 04:23:46PM +0200, Sumit Bose wrote:
> > > > > Hi,
> > > > >
> > > > > David Woodhouse identified an issue with Kerberos ticket renewal.
> > > > > Attached two patches fix two issues related to the authtok refactoring
> > > > > which make renewal for me working again.
> > > > >
> > > > > bye,
> > > > > Sumit
> > > >
> > > > Works for me, too. Ack.
> > >
> > > Pushed both to master.
> >
> > An improvement, but still not working.
> >
> > Firstly I have to revert commit 3438815242464a963c0d3a70f16579723a20b52d
> > ("LDAP: Retry SID search based on result of LDAP search, not the return
> > code") because otherwise I can't log in at all (I sent logs in private
> > mail).
> >
>
> The login failure is not related to the commit per se, the commit is
> actually correct and gets you further in the login process, but then you
> hit the old bug with the referral. I'm still not quite sure why SSSD
> decided to contact LDAP there and not the GC.
>
> > Then it does actually seem to be *trying* to renew, but I get the
> > following:
> >
>
> [snip]
>
> > FWIW running 'kinit -R' manually does work.
>
> As discussed on #sssd, this is a bug in how we renew enterprise
> principals.
The attached patch should fix the issue by not using enterprise
principals for renewals. David was so kind to test it and gave positive
feedback via irc.
bye,
Sumit
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
-------------- next part --------------
From a8fde9e99be783cdb79a0d23b73916f50dd146d6 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Mon, 24 Jun 2013 21:39:36 +0200
Subject: [PATCH] krb5: do not use enterprise principals for renewals
When renewing a ticket we already know the canonical principal hence it
is not needed to expand it to an enterprise principal but we can contact
the KDC of the corresponding realm directly.
---
src/providers/krb5/krb5_child_handler.c | 7 ++++++-
1 files changed, 6 insertions(+), 1 deletions(-)
diff --git a/src/providers/krb5/krb5_child_handler.c b/src/providers/krb5/krb5_child_handler.c
index 161fa26..1da7e4f 100644
--- a/src/providers/krb5/krb5_child_handler.c
+++ b/src/providers/krb5/krb5_child_handler.c
@@ -148,8 +148,13 @@ static errno_t create_send_buffer(struct krb5child_req *kr,
} else {
send_pac = 1;
}
- use_enterprise_principal = dp_opt_get_bool(kr->krb5_ctx->opts,
+
+ if (kr->pd->cmd == SSS_CMD_RENEW) {
+ use_enterprise_principal = false;
+ } else {
+ use_enterprise_principal = dp_opt_get_bool(kr->krb5_ctx->opts,
KRB5_USE_ENTERPRISE_PRINCIPAL) ? 1 : 0;
+ }
buf = talloc(kr, struct io_buffer);
if (buf == NULL) {
--
1.7.7.6
More information about the sssd-devel
mailing list