SSSD / sssd

#466 LDAP backend pollutes event log when using GSSAPI authentication
Closed: Fixed Opened by eindenbom.

Closed: Fixed
Reopen Issue

When using GSSAPI to authenticate with LDAP server, it is essential to close LDAP connection before GSSAPI ticket is expired.

If connection is used or closed when GSSAPI ticket is already expired, an error messages is added to message log.

Mar 18 16:54:29 node-1 sssd_be: GSSAPI Error: The referenced context has
expired (Unknown error)

When we establish a connection, we should add a timer event to fire a few minutes before the ticket would expire and mark the connection offline (forcing a reconnection).

component: SSSD => LDAP Provider
milestone: NEEDS_TRIAGE => SSSD 1.3.0
owner: somebody => simo

Fields changed

owner: simo => sgallagh

A different way to solve this is using sdap_check_gssapi_reconnect() at the beginning of the request. Currently this function is only used after an error to see if a new kinit and a reconnect might help.

Fields changed

owner: sgallagh => eindenbom

Fixed by

- 09c170c5b5cf0d62e7302ef284a1e35072ef1d95
- 1639954090616f9e868a083f358c87e381b3fb78
- 056901f031d8df43ec4fc7e67bc43dd5d967de71
- ee3b4d1d0a6a438626e2dbbae3bf96d2d6faaf18
- 9e67de38894e0fb6f82d66c62683e9dc2d030aa0
- 6c121f20f50158cdc58c0ac3c712f9ffc7540aef
- eef6302a20f9ddac77cf00f48ee68a5daacd6eb6
- bb6634510bbbb4a5499fb4aa8b4a3cba6f9f6bc8
- 54577e54d1b6300aeb348087372c14ed72530f88
- 2d7a7b0140a4d3fcef9148900276e24f82e33866
- faace4bdd6b84f60d2f707c00d31a84c0e84d375
- a2cabe1873c4d01c18ef6617b6b1f10a0ce3560e

fixedin: => 1.3.0
resolution: => fixed
status: new => closed

Fields changed

rhbz: => 0

Metadata Update from @eindenbom:
- Issue assigned to eindenbom
- Issue set to the milestone: SSSD 1.3.0

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/1508

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
Normal
defect
LDAP Provider
1.1.1
0
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.