[19285] in Kerberos_V5_Development
Re: Gss context refresh failure due to clock skew
daemon@ATHENA.MIT.EDU (Greg Hudson)
Wed Oct 7 10:45:30 2015
To: "Adamson, Andy" <William.Adamson@netapp.com>,
Benjamin Kaduk <kaduk@mit.edu>
From: Greg Hudson <ghudson@mit.edu>
Message-ID: <56152FF4.8050705@mit.edu>
Date: Wed, 7 Oct 2015 10:45:08 -0400
MIME-Version: 1.0
In-Reply-To: <EEF67DC8-C71A-4914-B614-EBEC63404F0B@netapp.com>
Cc: Linux NFS Mailing List <linux-nfs@vger.kernel.org>,
"krbdev@mit.edu" <krbdev@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On 10/07/2015 09:22 AM, Adamson, Andy wrote:
> Actually, setting the service ticket lifetime to be equal to (or greater than if this is possible) the TGT lifetime will not help. Just as in the example I sent, the application will get permission denied during the time difference between the client and server clock.
That is expected. What is not expected, in this variant, is that
gss_init_sec_context() will succeed by itself once the client believes
the TGT and service ticket to have expired. Apologies for any
miscommunication on this point.
There may be something in the calling code which refreshes the TGT in
this situation. If so, then to fully understand the scenario, we need
to know how the calling code decides when to refresh the TGT.
I opened a ticket about this issue here:
http://krbdev.mit.edu/rt/Ticket/Display.html?id=8268
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
