Bug 1287119

Summary:	RFE: please add support for TGT lifetime notifications
Product:	Red Hat Enterprise Linux 6	Reporter:	Ondrej <ondrej.valousek>
Component:	krb5-auth-dialog	Assignee:	Alexander Larsson <alexl>
Status:	CLOSED WONTFIX	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	6.8	CC:	jhrozek, pkis
Target Milestone:	rc	Keywords:	FutureFeature
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Enhancement
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-12-06 11:59:47 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Ondrej 2015-12-01 14:34:05 UTC

Description of problem:
Currently, krb5-auth-dialog only supports notifications based on expiring TGTs. In our case TGT never expires as it is being automatically renewed by the SSSD daemon - until it hits the lifetime period.

It would be therefore more beneficial if we could configure krb5-auth-dialog the way that it warns user that the Kerberos ticket lifetime is approaching.

Also in cases where user has obtained a renewable TGT, this dialog should not prompt for password - instead it should perhaps offer a possibility to perform renewal on user behalf automatically.

Comment 2 Jakub Hrozek 2015-12-01 16:03:14 UTC

This would be best served by the InfoPipe API of SSSD and overall the desktop integration Alexander is working on.

Comment 3 Ondrej 2015-12-01 18:51:20 UTC

That would, indeed. But that seems to be quite a long run project which will hardly make it into RHEL-7. What I am looking for here is something quick and relatively easy fix for RHEL-6 and/or 7 which can serve in the mean time.

Comment 4 Jan Kurik 2017-12-06 11:59:47 UTC

Red Hat Enterprise Linux 6 is in the Production 3 Phase. During the Production 3 Phase, Critical impact Security Advisories (RHSAs) and selected Urgent Priority Bug Fix Advisories (RHBAs) may be released as they become available.

The official life cycle policy can be reviewed here:

http://redhat.com/rhel/lifecycle

This issue does not meet the inclusion criteria for the Production 3 Phase and will be marked as CLOSED/WONTFIX. If this remains a critical requirement, please contact Red Hat Customer Support to request a re-evaluation of the issue, citing a clear business justification. Note that a strong business justification will be required for re-evaluation. Red Hat Customer Support can be contacted via the Red Hat Customer Portal at the following URL:

https://access.redhat.com/