Addresses #2053 and #2094
Check old ccaches only if needed, always precreate containing directory if we are goign to proceed with authentication and always fallback to old algorithm to check user presence on the system if systemd-login fails or returns negative result.
(Patches as agreed on IRC after several discussions)
All tested and apparently working.
Simo.
On Fri, Sep 20, 2013 at 01:04:06PM -0400, Simo Sorce wrote:
Addresses #2053 and #2094
Check old ccaches only if needed, always precreate containing directory if we are goign to proceed with authentication and always fallback to old algorithm to check user presence on the system if systemd-login fails or returns negative result.
(Patches as agreed on IRC after several discussions)
All tested and apparently working.
Sorry, I didn't have the time to test the first two patches yet, but I'd like to have the third one pushed asap.
So ACK to the third patch. I think it matches what we agreed on IRC -- only positive match from logind is now authoritative, negative is only taken into account if checking proc failed.
On Tue, 2013-09-24 at 12:59 +0200, Jakub Hrozek wrote:
On Fri, Sep 20, 2013 at 01:04:06PM -0400, Simo Sorce wrote:
Addresses #2053 and #2094
Check old ccaches only if needed, always precreate containing directory if we are goign to proceed with authentication and always fallback to old algorithm to check user presence on the system if systemd-login fails or returns negative result.
(Patches as agreed on IRC after several discussions)
All tested and apparently working.
Sorry, I didn't have the time to test the first two patches yet, but I'd like to have the third one pushed asap.
So ACK to the third patch. I think it matches what we agreed on IRC -- only positive match from logind is now authoritative, negative is only taken into account if checking proc failed.
You really need the first one too. It fixes a bug that causes issues on authentication.
Simo.
On Tue, Sep 24, 2013 at 08:53:32AM -0400, Simo Sorce wrote:
On Tue, 2013-09-24 at 12:59 +0200, Jakub Hrozek wrote:
On Fri, Sep 20, 2013 at 01:04:06PM -0400, Simo Sorce wrote:
Addresses #2053 and #2094
Check old ccaches only if needed, always precreate containing directory if we are goign to proceed with authentication and always fallback to old algorithm to check user presence on the system if systemd-login fails or returns negative result.
(Patches as agreed on IRC after several discussions)
All tested and apparently working.
Sorry, I didn't have the time to test the first two patches yet, but I'd like to have the third one pushed asap.
So ACK to the third patch. I think it matches what we agreed on IRC -- only positive match from logind is now authoritative, negative is only taken into account if checking proc failed.
You really need the first one too. It fixes a bug that causes issues on authentication.
Simo.
OK, ACK to the first patch, too. I haven't found any issues with it (although I must confess I only tested with DIR cache).
But the second patch seems to break offline authentication. Normally, when a user logs in offline, he is supposed to have an expired TGT so that it can be renewed once sssd gets online. But with the 2nd patch I'm not seeing that behaviour:
$ su - tuser@ad.example.com Password: [tuser@AD.EXAMPLE.COM@adclient ~]$ klist klist: No credentials cache found (ticket cache DIR::/run/user/1983201105/krb5cc/tkt)
On Wed, Sep 25, 2013 at 02:04:11PM +0200, Jakub Hrozek wrote:
On Tue, Sep 24, 2013 at 08:53:32AM -0400, Simo Sorce wrote:
On Tue, 2013-09-24 at 12:59 +0200, Jakub Hrozek wrote:
On Fri, Sep 20, 2013 at 01:04:06PM -0400, Simo Sorce wrote:
Addresses #2053 and #2094
Check old ccaches only if needed, always precreate containing directory if we are goign to proceed with authentication and always fallback to old algorithm to check user presence on the system if systemd-login fails or returns negative result.
(Patches as agreed on IRC after several discussions)
All tested and apparently working.
Sorry, I didn't have the time to test the first two patches yet, but I'd like to have the third one pushed asap.
So ACK to the third patch. I think it matches what we agreed on IRC -- only positive match from logind is now authoritative, negative is only taken into account if checking proc failed.
You really need the first one too. It fixes a bug that causes issues on authentication.
Simo.
OK, ACK to the first patch, too. I haven't found any issues with it (although I must confess I only tested with DIR cache).
Patch #1 pushed to master and sssd-1-11 Patch #2 needs revision Patch #3 pushed to master only (as we don't have logind support in 1.11)
On Wed, 2013-09-25 at 14:04 +0200, Jakub Hrozek wrote:
On Tue, Sep 24, 2013 at 08:53:32AM -0400, Simo Sorce wrote:
On Tue, 2013-09-24 at 12:59 +0200, Jakub Hrozek wrote:
On Fri, Sep 20, 2013 at 01:04:06PM -0400, Simo Sorce wrote:
Addresses #2053 and #2094
Check old ccaches only if needed, always precreate containing directory if we are goign to proceed with authentication and always fallback to old algorithm to check user presence on the system if systemd-login fails or returns negative result.
(Patches as agreed on IRC after several discussions)
All tested and apparently working.
Sorry, I didn't have the time to test the first two patches yet, but I'd like to have the third one pushed asap.
So ACK to the third patch. I think it matches what we agreed on IRC -- only positive match from logind is now authoritative, negative is only taken into account if checking proc failed.
You really need the first one too. It fixes a bug that causes issues on authentication.
Simo.
OK, ACK to the first patch, too. I haven't found any issues with it (although I must confess I only tested with DIR cache).
But the second patch seems to break offline authentication. Normally, when a user logs in offline, he is supposed to have an expired TGT so that it can be renewed once sssd gets online. But with the 2nd patch I'm not seeing that behaviour:
$ su - tuser@ad.example.com Password: [tuser@AD.EXAMPLE.COM@adclient ~]$ klist klist: No credentials cache found (ticket cache DIR::/run/user/1983201105/krb5cc/tkt)
Haven't found what causes this yet, however in the meanwhile attached find the patch rebased on top of the one for #2071 I just sent to the other thread.
Simo.
sssd-devel@lists.fedorahosted.org
-
Jakub Hrozek -
Simo Sorce