Does this separate thread connection need another as_req/rep pair?

Chris Hecker checker at d6.com
Thu May 7 05:54:54 EDT 2015


Okay, I have a client communicating with a server, and they've gone 
through the AS_REQ/AS_REP dance and that's all working fine.

Now, I want the server to send the client info about another connection 
it needs to make back to the server on another thread.  Does this 
connection need to do another AS_REQ/AS_REP exchange, or is there some 
cool way to take advantage of the original authentication on the first 
thread?

Basically, in my tests I've found the initial AS_REQ authentication is 
pretty slow, so I end up timeslicing it when I've got lots of 
connections to the first thread, and I'd rather not have to take the 
time to do that again on the second thread if I don't need to. 
Sometimes the server will tell the client to connect to a completely 
different machine, so obviously in that case I need the full authn 
exchange (I assume), but in the case where it's a connection back to the 
same process, it'd be nice if there was some way to skip this step.

I don't think I could use the same auth_context in the second thread 
(even with a mutex) because I don't know which order things will come 
in, and I'm using DO_SEQUENCE so I think the mk_priv/rd_priv pairs have 
to happen in order, which I can't guarantee with another thread.

Am I missing something, or do I have to bite the bullet and do the full 
AS_REQ/AS_REP thing on the second connection?

Let me know if that doesn't make sense.

Thanks,
Chris



More information about the Kerberos mailing list