Bug 1722210
| Summary: | goa-daemon spams log file due to expired Kerberos logins when using KCM ticket cache (sssd-kcm) | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Joe Wright <jwright> |
| Component: | gnome-online-accounts | Assignee: | Debarshi Ray <debarshir> |
| Status: | CLOSED WONTFIX | QA Contact: | Desktop QE <desktop-qa-list> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.6 | CC: | a.korsunsky, apeddire, brclark, cpippin, debarshir, extras-qa, florian.faltermeier, liebundartig, mfabian, negativo17, nrm, tmdag |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 1601438 | Environment: | |
| Last Closed: | 2020-08-27 15:41:31 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1601438, 1774580 | ||
| Bug Blocks: | |||
|
Description
Joe Wright
2019-06-19 17:14:23 UTC
*** Bug 1724521 has been marked as a duplicate of this bug. *** Do you still see this problem? I am asking because on many of the other reports about the same bug, people have been saying that they saw this issue go away over time. If you are still seeing this, then I need some more information because while it seems to constantly affect some users, it just doesn't reproduce for others. If you start from a clean state (ie., no Kerberos tickets or accounts anywhere) then what are the exact steps to trigger this? To attain a clean state: * Hard disable /usr/libexec/goa-daemon and /usr/libexec/goa-identity-service by removing the executable bit and killing them, so that they don't start up again. * Remove all stanzas with "IsTemporary=true" or "Provider=kerberos". Or even better, just remove that file. * Reboot the machine just to reset all the SSSD daemons, which offer the Kerberos KCM caches. * Restore the executable bit on /usr/libexec/goa-daemon and /usr/libexec/goa-identity-service. At this point, what are the exact steps that cause this bug to appear? For example, are you creating your Kerberos tickets using kinit? Or are you creating your tickets using the Online Accounts GUI in Settings? If you are using the GUI, then do you select the checkbox to save your password? Do you add more than one Kerberos account? Or just one? I suspect that kinit was used, not the GUI. If so, when does this behaviour show up? Does one have to wait for the ticket to expire? Also, does your Kerberos Key Distribution Centre (or KDC) allow tickets to be renewed or not? The customer that the listing was opened for mentioned that the issue is still occurring, albeit infrequently. As such, they are unable to determine steps for reproducing until their production outage in May. However, they have confirmed that they're using MS AD which does renew the tickets. (In reply to Brandon Clark from comment #4) > The customer that the listing was opened for mentioned that the issue is > still occurring, albeit infrequently. As such, they are unable to determine > steps for reproducing until their production outage in May. > > However, they have confirmed that they're using MS AD which does renew the > tickets. Ok, that's good to know. > * Remove all stanzas with "IsTemporary=true" or "Provider=kerberos". Or > even better, just remove that file. By "that file", I mean ~/.config/goa-1.0/accounts.conf Setting NEEDINFO while we wait for further details. Closing the bug as the attached customer case is closed. |