[freeipa PR#855][opened] Prevent issues with older clients

[simo5]

   URL: https://github.com/freeipa/freeipa/pull/855
Author: simo5
 Title: #855: Prevent issues with older clients
Action: opened

PR body:
"""
Older clients have issues parsing cookies, and cannot handle well the MaxAge setting.
So the first patch is about removing it.

Unfortunately this means cookies will be valid for the duration of the authentication
ticket which is set to 24h by default.
This is a bit high, so the second patch adds the ability to set the
"kinit_lifetime" in /etc/api/default.conf so that users authenticating using
username/password can have their tickets (and therefore their session) hard capped at
whatever lifetime is set there.

Users that use HTTP negotiate can control their session duration by getting shorter lived
tickets via kinit.

In all cases users can click on the logout button to blow away credentials.
"""

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/855/head:pr855
git checkout pr855

[freeipa PR#855][comment] Prevent issues with older clients

[simo5]

  URL: https://github.com/freeipa/freeipa/pull/855
Title: #855: Prevent issues with older clients

simo5 commented:
"""
Fixes https://pagure.io/freeipa/issue/6774
"""

See the full comment at
https://github.com/freeipa/freeipa/pull/855#issuecomment-306538965

[freeipa PR#855][comment] Prevent issues with older clients

[simo5]

  URL: https://github.com/freeipa/freeipa/pull/855
Title: #855: Prevent issues with older clients

simo5 commented:
"""
In my test setup I verified the cookie does not have the MaxAge setting, and that
kinit_lifetime properly causes the session to expire after the lifetime indicated.
"""

See the full comment at
https://github.com/freeipa/freeipa/pull/855#issuecomment-306539239

[freeipa PR#855][comment] Prevent issues with older clients

[abbra]

  URL: https://github.com/freeipa/freeipa/pull/855
Title: #855: Prevent issues with older clients

abbra commented:
"""
Pylint failed:
```
************* Module ipaserver.rpcserver
ipaserver/rpcserver.py:973: [E1101(no-member), login_password.kinit] Class 'env'
has no 'kinit_lifetime' member)
make: *** [pylint] Error 2
```

Do we want to set `kinit_lifetime` during upgrade if it is missing?

"""

See the full comment at
https://github.com/freeipa/freeipa/pull/855#issuecomment-306563697

[freeipa PR#855][comment] Prevent issues with older clients

[simo5]

  URL: https://github.com/freeipa/freeipa/pull/855
Title: #855: Prevent issues with older clients

simo5 commented:
"""
I thought just defining it as None in the constants was enough ?
We do not want to set a kinit_lifetime entry in defaults.conf, I am ok with the default
being None for now I think.
"""

See the full comment at
https://github.com/freeipa/freeipa/pull/855#issuecomment-306616228

[freeipa PR#855][+prioritized] Prevent issues with older clients

[pvoborni]

  URL: https://github.com/freeipa/freeipa/pull/855
Title: #855: Prevent issues with older clients

Label: +prioritized

[freeipa PR#855][synchronized] Prevent issues with older clients

[simo5]

   URL: https://github.com/freeipa/freeipa/pull/855
Author: simo5
 Title: #855: Prevent issues with older clients
Action: synchronized

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/855/head:pr855
git checkout pr855

[freeipa PR#855][comment] Prevent issues with older clients

[simo5]

  URL: https://github.com/freeipa/freeipa/pull/855
Title: #855: Prevent issues with older clients

simo5 commented:
"""
Change to used the correct bug number:
https://pagure.io/freeipa/issue/7001
"""

See the full comment at
https://github.com/freeipa/freeipa/pull/855#issuecomment-306741024

[freeipa PR#855][comment] Prevent issues with older clients

[abbra]

  URL: https://github.com/freeipa/freeipa/pull/855
Title: #855: Prevent issues with older clients

abbra commented:
"""
Looks like pylint is unhappy with such definitions. For most of other options from
default.conf we have them explicitly set in `Env._bootstrap()`.
"""

See the full comment at
https://github.com/freeipa/freeipa/pull/855#issuecomment-306755293

[freeipa PR#855][comment] Prevent issues with older clients

[pvoborni]

  URL: https://github.com/freeipa/freeipa/pull/855
Title: #855: Prevent issues with older clients

pvoborni commented:
"""
@MartinBasti is the correct way how to solve this pylint issue to extend
pylint_plugins.py?

snippet. of similar vars: 
```python
fake_api_env = {'env': [
    'host',
    'realm',
    'session_auth_duration',
    'session_duration_type',
]}

# this is due ipaserver.rpcserver.KerberosSession where api is undefined
fake_api = {'api': [fake_api_env] + NAMESPACE_ATTRS}
```
"""

See the full comment at
https://github.com/freeipa/freeipa/pull/855#issuecomment-306758867

[freeipa PR#855][comment] Prevent issues with older clients

[MartinBasti]

  URL: https://github.com/freeipa/freeipa/pull/855
Title: #855: Prevent issues with older clients

MartinBasti commented:
"""
@pvoborni yes, this is the way how to handle false positive missing members in pylint
"""

See the full comment at
https://github.com/freeipa/freeipa/pull/855#issuecomment-306759907

[freeipa PR#855][synchronized] Prevent issues with older clients

[simo5]

   URL: https://github.com/freeipa/freeipa/pull/855
Author: simo5
 Title: #855: Prevent issues with older clients
Action: synchronized

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/855/head:pr855
git checkout pr855

[freeipa PR#855][comment] Prevent issues with older clients

[simo5]

  URL: https://github.com/freeipa/freeipa/pull/855
Title: #855: Prevent issues with older clients

simo5 commented:
"""
Ok I added it to pylint_plugins, hopefully it is addressed fully now

"""

See the full comment at
https://github.com/freeipa/freeipa/pull/855#issuecomment-306767611

[freeipa PR#855][+ack] Prevent issues with older clients

[pvomacka]

  URL: https://github.com/freeipa/freeipa/pull/855
Title: #855: Prevent issues with older clients

Label: +ack

[freeipa PR#855][comment] Prevent issues with older clients

[MartinBasti]

  URL: https://github.com/freeipa/freeipa/pull/855
Title: #855: Prevent issues with older clients

MartinBasti commented:
"""
master:

* 77db574cca900eb03d8e0ab577568c2058ae4a86 Add code to be able to set default kinit
lifetime
* c52ca92cdabf07da5b3b27344b8eaa8b161ea49b Revert setting sessionMaxAge for old clients


ipa-4-5:

* 0def2ec653ac29210414aa09499b309dd1c3ac7d Add code to be able to set default kinit
lifetime
* 728e2f681a938f25d091a8480ec6db3961ebfc98 Revert setting sessionMaxAge for old clients


"""

See the full comment at
https://github.com/freeipa/freeipa/pull/855#issuecomment-306796858

[freeipa PR#855][+pushed] Prevent issues with older clients

[MartinBasti]

  URL: https://github.com/freeipa/freeipa/pull/855
Title: #855: Prevent issues with older clients

Label: +pushed

[freeipa PR#855][closed] Prevent issues with older clients

[MartinBasti]

   URL: https://github.com/freeipa/freeipa/pull/855
Author: simo5
 Title: #855: Prevent issues with older clients
Action: closed

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/855/head:pr855
git checkout pr855