[SSSD] [PATCH] krb5: do not use enterprise principals for renewals (was: [PATCHES] Fix krb5 ticket renewal)

Sumit Bose sbose at redhat.com
Tue Jun 25 09:25:32 UTC 2013


On Mon, Jun 24, 2013 at 06:22:35PM +0200, Jakub Hrozek wrote:
> On Mon, Jun 24, 2013 at 04:28:10PM +0100, David Woodhouse wrote:
> > On Mon, 2013-06-24 at 17:01 +0200, Jakub Hrozek wrote:
> > > On Mon, Jun 24, 2013 at 04:59:33PM +0200, Jakub Hrozek wrote:
> > > > On Mon, Jun 24, 2013 at 04:23:46PM +0200, Sumit Bose wrote:
> > > > > Hi,
> > > > > 
> > > > > David Woodhouse identified an issue with Kerberos ticket renewal.
> > > > > Attached two patches fix two issues related to the authtok refactoring
> > > > > which make renewal for me working again.
> > > > > 
> > > > > bye,
> > > > > Sumit
> > > > 
> > > > Works for me, too. Ack.
> > > 
> > > Pushed both to master.
> > 
> > An improvement, but still not working.
> > 
> > Firstly I have to revert commit 3438815242464a963c0d3a70f16579723a20b52d
> > ("LDAP: Retry SID search based on result of LDAP search, not the return
> > code") because otherwise I can't log in at all (I sent logs in private
> > mail).
> > 
> 
> The login failure is not related to the commit per se, the commit is
> actually correct and gets you further in the login process, but then you
> hit the old bug with the referral. I'm still not quite sure why SSSD
> decided to contact LDAP there and not the GC.
> 
> > Then it does actually seem to be *trying* to renew, but I get the
> > following:
> > 
> 
> [snip]
> 
> > FWIW running 'kinit -R' manually does work.
> 
> As discussed on #sssd, this is a bug in how we renew enterprise
> principals.

The attached patch should fix the issue by not using enterprise
principals for renewals. David was so kind to test it and gave positive
feedback via irc.

bye,
Sumit
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
-------------- next part --------------
From a8fde9e99be783cdb79a0d23b73916f50dd146d6 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Mon, 24 Jun 2013 21:39:36 +0200
Subject: [PATCH] krb5: do not use enterprise principals for renewals

When renewing a ticket we already know the canonical principal hence it
is not needed to expand it to an enterprise principal but we can contact
the KDC of the corresponding realm directly.
---
 src/providers/krb5/krb5_child_handler.c |    7 ++++++-
 1 files changed, 6 insertions(+), 1 deletions(-)

diff --git a/src/providers/krb5/krb5_child_handler.c b/src/providers/krb5/krb5_child_handler.c
index 161fa26..1da7e4f 100644
--- a/src/providers/krb5/krb5_child_handler.c
+++ b/src/providers/krb5/krb5_child_handler.c
@@ -148,8 +148,13 @@ static errno_t create_send_buffer(struct krb5child_req *kr,
     } else {
         send_pac = 1;
     }
-    use_enterprise_principal = dp_opt_get_bool(kr->krb5_ctx->opts,
+
+    if (kr->pd->cmd == SSS_CMD_RENEW) {
+        use_enterprise_principal = false;
+    } else {
+        use_enterprise_principal = dp_opt_get_bool(kr->krb5_ctx->opts,
                                          KRB5_USE_ENTERPRISE_PRINCIPAL) ? 1 : 0;
+    }
 
     buf = talloc(kr, struct io_buffer);
     if (buf == NULL) {
-- 
1.7.7.6



More information about the sssd-devel mailing list