[SSSD] [PATCHES] Fix old ccache testing behavior

Simo Sorce simo at redhat.com
Wed Sep 25 21:51:09 UTC 2013


On Wed, 2013-09-25 at 14:04 +0200, Jakub Hrozek wrote:
> On Tue, Sep 24, 2013 at 08:53:32AM -0400, Simo Sorce wrote:
> > On Tue, 2013-09-24 at 12:59 +0200, Jakub Hrozek wrote:
> > > On Fri, Sep 20, 2013 at 01:04:06PM -0400, Simo Sorce wrote:
> > > > Addresses #2053 and #2094
> > > > 
> > > > Check old ccaches only if needed, always precreate containing directory
> > > > if we are goign to proceed with authentication and always fallback to
> > > > old algorithm to check user presence on the system if systemd-login
> > > > fails or returns negative result.
> > > > 
> > > > (Patches as agreed on IRC after several discussions)
> > > > 
> > > > All tested and apparently working.
> > > 
> > > Sorry, I didn't have the time to test the first two patches yet, but I'd
> > > like to have the third one pushed asap.
> > > 
> > > So ACK to the third patch. I think it matches what we agreed on IRC --
> > > only positive match from logind is now authoritative, negative is only
> > > taken into account if checking proc failed.
> > 
> > You really need the first one too. It fixes a bug that causes issues on
> > authentication.
> > 
> > Simo.
> 
> OK, ACK to the first patch, too. I haven't found any issues with it
> (although I must confess I only tested with DIR cache).
> 
> But the second patch seems to break offline authentication. Normally,
> when a user logs in offline, he is supposed to have an expired TGT so
> that it can be renewed once sssd gets online. But with the 2nd patch I'm not
> seeing that behaviour:
> 
> $ su - tuser at ad.example.com
> Password: 
> [tuser at AD.EXAMPLE.COM@adclient ~]$ klist 
> klist: No credentials cache found (ticket cache
> DIR::/run/user/1983201105/krb5cc/tkt)

Haven't found what causes this yet, however in the meanwhile attached
find the patch rebased on top of the one for #2071 I just sent to the
other thread.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-krb5-Improve-ccache-name-checks.patch
Type: text/x-patch
Size: 7499 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130925/0c2e72ae/attachment.bin>


More information about the sssd-devel mailing list