GSS-API errors

[Mike Friedman]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 29 Oct 2009 at 13:00 (-0400), Greg Hudson wrote:

> On Thu, 2009-10-29 at 12:37 -0400, Mike Friedman wrote:
>> Any ideas about how, at least, to track down the cause of these 
>> particular errors?  Is the mere attempt to make a couple of dozen or 
>> more kadmin connections per second likely to cause this problem?
>
> You might be running into a replay cache issue.  In krb5 1.6, the replay 
> cache keyed mostly off of the timestamp of the authenticator, which 
> could be the same if you make two connections in quick succession.  In 
> 1.7 we also key off a checksum of the encrypted authenticator, which is 
> very unlikely to collide because of the confounder.

> As a workaround, it's possible to perform multiple operations within a 
> single connection.  I don't know if Authen::Krb5::Admin allows that, 
> though.

Greg,

Unfortunately, my library of Kerberos routines consists only of standalone 
functions, each of which makes its own kadmind connection.  I realize I 
should also have provided a method that just returned a kadm5 handle so 
that calling routines could do multiple transactions on the same 
connection.  But then it would be the responsibility of each such calling 
application to track the persistence of the connection.

For example, updates will fail while kprop is unloading the db. 
Currently, an app can just retry the standalone function, which will 
establish a new connection.  Anyway, wise or not, I didn't provide a 
connection-only perl method, so apps that call my functions (e.g., to add 
a principal) wind up connecting to kadmind each time.

Are you saying that with 1.7 and later releases, this problem should go 
away (assuming its cause is as you speculate)?

Mike

_________________________________________________________________________
Mike Friedman                        Information Services & Technology
mikef at berkeley.edu                   2484 Shattuck Avenue
1-510-642-1410                       University of California at Berkeley
http://mikef.berkeley.edu            http://ist.berkeley.edu
_________________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (FreeBSD)

iEYEARECAAYFAkrpzWcACgkQFgKSfLOvZ1Sx/ACeJDiBR6jNAH8bptDxG6svZjeA
BfMAn3qFmD2VlrLFo+ZuMiHgmunmofPf
=dlxd
-----END PGP SIGNATURE-----