freeipa

#9624 A missing cccache prevents Kerberos SSO
Closed: fixed by frenaud. Opened by rcritten.

Closed: fixed
Reopen Issue

Issue

As seen in https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahosted.org/thread/R5YP7TIBCLQ3OOF3BFQPOPRYUGVZW4JL/

If you have a valid Kerberos SSO session to the UI and remove the cacches then subsequent Kerboros logins will fail and the user will be dumped to the username/password screen.

Steps to Reproduce

  1. kinit as a user
  2. launch a browser and go to /ipa/ui
  3. in another window as root: rm -rf /run/ipa/ccaches/*
  4. F5 in the browser

Actual behavior

It'll dump you to the login screen

Expected behavior

user should get a new session

Additional info:

A workaround is to remove the IPA server cookies in the browser. Then SSO will work again.

The fix will be to invalidate any ipa_session token. The question is do we always do this or only in certain cases when calling need_login()?

Metadata Update from @rcritten:
- Issue assigned to rcritten

master:

  • 64937571fdf3534b89d8db9ccb8b5ac1abfb5a6d Force a logout in KerberosSession if a login is needed

ipa-4-12:

  • ffba69648aa6b20cdc3d8950a982b49fd8004aa2 Force a logout in KerberosSession if a login is needed

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/7434
Metadata
None
None
None
Normal
https://github.com/freeipa/freeipa/pull/7434
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.