Re: Strange cred expiry behavior

[Steve Dickson <SteveD@redhat.com>]

On 21/10/13 22:38, Weston Andros Adamson wrote:
> 
> On Oct 21, 2013, at 10:31 PM, Weston Andros Adamson <dros@netapp.com>
>  wrote:
> 
>>
>> On Oct 21, 2013, at 10:23 PM, Jeff Layton <jlayton@poochiereds.net> wrote:
>>
>>> On Mon, 21 Oct 2013 23:53:16 +0000
>>> Weston Andros Adamson <dros@netapp.com> wrote:
>>>
>>>> I traced this behavior back to:
>>>>
>>>> commit 302de786930a2c533068f9d8909a817b40f07c32
>>>> Author: Simo Sorce <simo@redhat.com>
>>>> Date:   Fri Apr 19 13:02:36 2013 -0400
>>>>
>>>>   gssd: Allow GSSAPI to try to acquire credentials first.
>>>>
>>>>
>>>> And in particular:
>>>>
>>>> -               for (dirname = ccachesearch; *dirname != NULL; dirname++) {
>>>> +               /* Try first to acquire credentials directly via GSSAPI */
>>>> +               err = gssd_acquire_user_cred(uid, &gss_cred);
>>>> +               if (!err)
>>>> +                       create_resp = create_auth_rpc_client(clp, &rpc_clnt, &auth, uid,
>>>> +                                                            AUTHTYPE_KRB5, gss_cred);
>>>> +               /* if create_auth_rplc_client fails try the traditional method of
>>>> +                * trolling for credentials */
>>>> +               for (dirname = ccachesearch; create_resp != 0 && *dirname != NULL; dirname++) {
>>>>
>>>
>>>
>>>> A couple of things:
>>>>
>>>> - If I get rid of the "Try first to acquire credentials directly via GSSAPI" part, expiry works as before.
>>>>
>>>
>>>
>>> Steve just merged a couple of patches from me that change this code
>>> some. It's probably worth testing with those before you make any
>>> changes.
>>>
>>
>> Thanks, I'll check it out.
> 
> Bisecting brought me to 302de786930a2c533068f9d8909a817b40f07c32 and I've confirmed that the problem is still in steved's master branch as of today. Are you sure the patches you're thinking of have been merged?
I believe the ones in question are 

commit 6b53fc9ce38ba6fff2fd5c2f6ed143747067a39d
Author: Jeff Layton <jlayton@redhat.com>
Date:   Mon Oct 21 13:28:06 2013 -0400

    gssd: do a more thorough change of identity after forking


commit f9cac65972da588d5218236de60a7be11247a8aa
Author: Jeff Layton <jlayton@redhat.com>
Date:   Mon Oct 21 13:27:22 2013 -0400

    gssd: have process_krb5_upcall fork before handling upcall

Which have been committed... 

steved.