[SSSD] [PATCH] https://fedorahosted.org/sssd/ticket/2410

Pavel Březina pbrezina at redhat.com
Fri Aug 22 15:21:11 UTC 2014


https://fedorahosted.org/sssd/ticket/2410

The problem is described in the ticket and commit message. Locking the 
ccache is one way to solve the problem. Another way would be to 
randomize the ccache name so both processes touches different file.

However, randomizing the name has two problems:
1) if I understand it correctly, it is still a cache so in theory it may 
be reused after SSSD is restarted, therefore we need to have a 
deterministic name anyway (for example appending $provider to ccache 
name but that would require changes in the protocol and sdap code).

2) the ccache name is stored in KRB5CCACHE (or something like that) 
environment variable so actually only one ccache may be used. Possible 
solution would be to create two files and than keep only one of them.

I think locking the file is a better solution. Besides initial condition 
where we perform first periodic tasks (sudo full refresh, subdomain 
refresh, possibly enumeration) there should be no collisions where the 
process would wait to obtain the lock.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-ldap_child-lock-ccache-file-prior-storing-credential.patch
Type: text/x-patch
Size: 3187 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140822/eb069191/attachment.bin>


More information about the sssd-devel mailing list