[SSSD] [PATCH] Detect re-created trusts on an IPA server

Sumit Bose sbose at redhat.com
Wed Sep 23 16:16:13 UTC 2015


On Wed, Sep 23, 2015 at 03:01:42PM +0200, Jakub Hrozek wrote:
> On Wed, Sep 23, 2015 at 10:09:40AM +0200, Jakub Hrozek wrote:
> > Hi,
> > 
> > the attached patches fix https://fedorahosted.org/sssd/ticket/2639
> > 
> > The first patches always retry fetching the keytab on lookup failure.
> > 
> > For the last two patches, I used Sumit's idea to check the last connection
> > time of the AD LDAP connection and compare it with the TDO modifyTimestamp
> > to only fetch the keytab and retry if there is a newer trust.
> > 
> > Testing is a bit tricky, but what I did is pretty much:
> >     $ getent passwd administrator at win.trust.test
> >     administrator at win.trust.test:*:962400500:962400500:Administrator:/home/win.trust.test/administrator:
> >     # Make sure sssd doesn't reuse already established and working
> >     # connection. Somewhat simulates GSSAPI connection expiring
> >     $ sudo pkill -USR1 sssd
> >     $ sudo pkill -USR2 sssd
> >     $ ipa trust-add --type=ad win.trust.test --admin Administrator --password
> >     # Make sure a wrong keytab is in place for the next connection
> >     # attempt
> >     $ sudo cp old.keytab /var/lib/sss/keytabs/win.trust.test.keytab
> >     $ sudo sss_cache -E
> >     $ getent passwd administrator at win.trust.test
> >     administrator at win.trust.test:*:962400500:962400500:Administrator:/home/win.trust.test/administrator:
> 
> Hi,
> 
> after IRC discussion with Sumit, I'm withdrawing the last two patches.
> At least for now, maybe even until we get nicer error reporting from
> sdap. It seems the time-based keytab check would be fragile and it would
> be better to rely on error code that would indicate the keytab can't be
> used.
> 
> Instead, the patch "FO: Also reset the server common data in addition to
> SRV" has more tests (actually it's more of refactoring of the current
> test to make adding new ones easier, the new test is then trivial).
> 
> No other changes were done to the patchset.
> 
> In the FO patch, it's easy to verify the fix with:
>     - git rebase, edit the fix
>     - git reset HEAD~1 src/providers/fail_over.c
>     - make check # Will fail
>     - git checkout src/providers/fail_over.c
>     - make check # Will pass
> 
> Since the test mostly cycles through servers, resets them and cycles again,
> which is something we can expect from failover users, I think this proves
> the fix well.

Hi,

the 4 patches look good, work as expected and pass CI
http://sssd-ci.duckdns.org/logs/job/27/65/summary.html, ACK.

bye,
Sumit


More information about the sssd-devel mailing list