From: Greg Hudson <ghudson@mit.edu>
To: "Adamson, Andy" <William.Adamson@netapp.com>,
Benjamin Kaduk <kaduk@mit.edu>
Cc: Linux NFS Mailing List <linux-nfs@vger.kernel.org>,
"krbdev@mit.edu" <krbdev@mit.edu>
Subject: Re: Gss context refresh failure due to clock skew
Date: Wed, 7 Oct 2015 10:45:08 -0400 [thread overview]
Message-ID: <56152FF4.8050705@mit.edu> (raw)
In-Reply-To: <EEF67DC8-C71A-4914-B614-EBEC63404F0B@netapp.com>
On 10/07/2015 09:22 AM, Adamson, Andy wrote:
> Actually, setting the service ticket lifetime to be equal to (or greater than if this is possible) the TGT lifetime will not help. Just as in the example I sent, the application will get permission denied during the time difference between the client and server clock.
That is expected. What is not expected, in this variant, is that
gss_init_sec_context() will succeed by itself once the client believes
the TGT and service ticket to have expired. Apologies for any
miscommunication on this point.
There may be something in the calling code which refreshes the TGT in
this situation. If so, then to fully understand the scenario, we need
to know how the calling code decides when to refresh the TGT.
I opened a ticket about this issue here:
http://krbdev.mit.edu/rt/Ticket/Display.html?id=8268
next prev parent reply other threads:[~2015-10-07 14:50 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <AD03968E-7017-4D32-A90C-C74C1E9CDFAC@netapp.com>
2015-10-01 21:30 ` Fwd: Gss context refresh failure due to clock skew Adamson, Andy
2015-10-05 19:10 ` Greg Hudson
2015-10-05 19:35 ` Adamson, Andy
2015-10-05 20:02 ` Greg Hudson
2015-10-05 20:34 ` Adamson, Andy
2015-10-06 0:02 ` Benjamin Kaduk
2015-10-06 14:53 ` Adamson, Andy
2015-10-07 13:22 ` Adamson, Andy
2015-10-07 14:45 ` Greg Hudson [this message]
2015-10-07 15:00 ` Adamson, Andy
2015-10-07 15:08 ` Greg Hudson
2015-10-07 15:46 ` Olga Kornievskaia
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=56152FF4.8050705@mit.edu \
--to=ghudson@mit.edu \
--cc=William.Adamson@netapp.com \
--cc=kaduk@mit.edu \
--cc=krbdev@mit.edu \
--cc=linux-nfs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox