Description of problem:
IdM with AD forest trust and kdcproxy enabled on IdM server.
In case trusted AD users try to access resources in the IdM domain, authentication requests might be sent to the kdcproxy running on the IdM server (using https) and from there the requests are forwarded to the AD KDCs using default Kerberos dst port 88/tcp and/or 88/udp. The kdcproxy tries to connect to all known AD KDCs. In case some of those KDCs are not reachable, (because of network filtering or other reasons), kdcproxy produces an error like the following one:
[Wed Nov 29 15:05:56.340762 2017] [:error] [pid 21339] ERROR:root:Error in recv() of <socket._socketobject object at 0x560cc3f80fa0>
[Wed Nov 29 15:05:56.340777 2017] [:error] [pid 21339] Traceback (most recent call last):
[Wed Nov 29 15:05:56.340782 2017] [:error] [pid 21339]   File "/usr/lib/python2.7/site-packages/kdcproxy/__init__.py", line 100, in __await_reply
[Wed Nov 29 15:05:56.340787 2017] [:error] [pid 21339]     sock.sendall(pr.request)
[Wed Nov 29 15:05:56.340791 2017] [:error] [pid 21339]   File "/usr/lib64/python2.7/socket.py", line 224, in meth
[Wed Nov 29 15:05:56.340795 2017] [:error] [pid 21339]     return getattr(self._sock,name)(*args)
[Wed Nov 29 15:05:56.340799 2017] [:error] [pid 21339] error: [Errno 32] Broken pipe
[Wed Nov 29 15:05:56.341031 2017] [:error] [pid 21339] ERROR:root:Error in recv() of <socket._socketobject object at 0x560cc4004e50>
[Wed Nov 29 15:05:56.341048 2017] [:error] [pid 21339] [Wed Nov 29 15:51:18.116347 2017] [mpm_prefork:notice] [pid 21333] AH00170: caught SIGWINCH, shutting down gracefully
In case a lot of trusted AD users are trying to login, this error can easily fill up the httpd error log and also quickly utilize all the available disk space which can lead to other problems (like httpd shutdown as seen above).
The RfE is to put some logic into kdcproxy to keep track of all KDCs which are not reachable to not send any auth requests to those servers until they are available again.
Version-Release number of selected component (if applicable):
gssproxy-0.7.0-4.el7.x86_64
How reproducible:
Steps to Reproduce:
1.
2.
3.
Actual results:
Expected results:
Additional info: