gssproxy

#162 Implement credentials synchronization back to the client
Merged by simo. Opened by simo.
simo/gssproxy refresh_creds  into  master

Download 162.patch

With the introduction of the in memory ccache for gssproxy we gain the fact that we do not litter the filesystem with ccaches and we have a better security proposition in that we do not risk ccaches mixupo, however we lost the ability to cache anything but the initial ticket/TGT because we never returned modified credential caches back to the client application.

This patcheset implements the ability to synchronize back to the client app in 2 cases. On credential acquisistion, in case credentials are renewed for example, and on context init, to account for new tickets and cache them back on the client side.

Some preparatory and general fixing patches for issues discovered during this work are included as the first commits, and some tests that were incorrectly depending on non-updated ccaches have been fixed as the last commit.

1 new commit added

  • Add support for the NO_CI_FLAG credentials option

This whole blob should probably be a helper function.

12 new commits added

  • Fix impersonate tests to cope with credential sync
  • Change tests to always exercise ccache sycns
  • If credentials changed try to store them
  • Always request cred sync on init_sec_context
  • Add utility function to compare gssx_creds
  • Rework gpp_cred_handle management
  • Fix potential memleak from gpm_release_cred
  • Do not re-export unchanged creds
  • Add ability to sync creds back on modification
  • Add a helper function to pack options
  • Still fall back to remote with cred_store
  • Do not check for remote cred in LOCAL_ONLY case

Please expand on this comment.

Mostly looks good. Things I would like to see:

  • "Do not check for remote cred in LOCAL_ONLY case" squashed with "Still fall back to remote with cred_store".
  • "Fix potential memleak from gpm_release_cred" should be the first commit in the series. I'd like to tag a new .z version with that commit and not the rest of this series.
  • "If credentials changed try to store them" breaks the test suite. For backporting purposes, it needs to not do that.
  • Should we be running at least some tests without ccache syncs?
  • Two more comments inline
  • Misc style/typos (I'll fix these up when merging, unless you'd prefer to do it.)

I'll probably have a second round of stuff; apologies in advance for that.

ok

I think I addressed all your points, please confirm.
For typos I can either rebase myself or you can push with those fixes.

rebased

Pushed to master as 94478d4df56fa48d81d434a6386138d6736ee60f

Pull-Request has been closed by rharwood

Commit c640f178 fixes this pull-request

Pull-Request has been merged by simo@redhat.com

Commit 94478d4d fixes this pull-request

Pull-Request has been merged by simo@redhat.com
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.