Bug 1017180 - Offline logins with krb5 keyring cache do not produce placeholder cache
Summary: Offline logins with krb5 keyring cache do not produce placeholder cache
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Fedora
Classification: Fedora
Component: sssd
Version: 20
Hardware: x86_64
OS: Linux
unspecified
low
Target Milestone: ---
Assignee: Jakub Hrozek
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On: 1017292 1146827
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-10-09 11:43 UTC by Stephen Gallagher
Modified: 2020-05-02 17:29 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-10-06 12:58:19 UTC
Type: Bug


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github SSSD sssd issues 3157 0 None None None 2020-05-02 17:29:42 UTC

Description Stephen Gallagher 2013-10-09 11:43:34 UTC
Description of problem:
When performing an offline login with no existing credential cache (first login after boot or after a kdestroy), the SSSD does not generate a pre-expired placeholder cache.

Version-Release number of selected component (if applicable):
sssd-krb5-1.11.1-2.fc20.x86_64

How reproducible:
Every time

Steps to Reproduce:
1. kdestroy
2. sudo killall -USR1 sssd (to force offline auth)
3. su - <username>
4. klist

Actual results:
The login succeeds with cached credentials, but the output of klist shows no credential cache.

Expected results:
The login succeeds with cached credentials and the output of klist shows a credential cache that expired long ago (actually the dawn of the epoch).

Additional info:
The primary reason for the placeholder cache is so that applications like krb5-auth-dialog can monitor the cache and notify the user when it is updated or expired.

Also, this appears to be related to the KEYRING:persistent cache only. When I switched to 'krb5_ccname_template = FILE:/tmp/krb5cc_%U_XXXXXX" and followed the above steps, the placeholder cache was properly created.

Comment 1 Jakub Hrozek 2013-10-09 11:44:43 UTC
Upstream ticket:
https://fedorahosted.org/sssd/ticket/2115

Comment 2 Simo Sorce 2014-09-26 15:35:31 UTC
Why do you need that with a kernel keyring ?

Comment 3 Lukas Slebodnik 2014-10-06 12:58:19 UTC
Upstream ticket was closed as wontfix. (https://fedorahosted.org/sssd/ticket/2115)


Note You need to log in before you can comment on or make changes to this bug.