> The document 
> https://freeipa.org/page/Troubleshooting/PrivilegeSeparation explains 
> the concepts in greater details.

Well this article is very valuable and answers most of my questions about the 
reasons for httpd and ipaapi service separation.

> Finally the ccache with the TGT is destoyed and the
> cookie is returned to the user.

So in the server-side process, the Ticket Granting Ticket (TGT) is obtained 
(your link to class login_password), but it is then discarded after acquiring 
the LDAP service ticket and setting the cookie. Consequently, if you possess an 
"ipa_session" cookie that is somehow linked to a particular service ticket for 
ldap in the "/run/ipa/ccaches" directory, the authorization code (which 
executes the "kinit" process) is not executed.

Thank you, I think the pieces of the puzzle are falling into place now.
_______________________________________________
FreeIPA-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedorahosted.org/archives/list/[email protected]
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Reply via email to