Tim-Christian Bloss commented on SVN-4641:


we've found out we're running into two alternating issues:

- When checking out 5 minutes before kerberos tickets come to end of life, 
checkout goes 5 minutes and on end of kerberos ticket validity checkout 
terminates without error code

- When checking out large svn structures which takes longer than apache timeout 
(due to massive network load), checkout terminates without error code when 
using kerberos.

The ticket indeed lasts 8-10 hours, but we've often managed in our automatic 
builds to checkout about 5 minutes before expiry and renewing happend to a "bad 
time" , and that reoccuring, so we see indeed checkouts terminate due to ticket 
expiry without getting error codes.

The checkout duration is not an issue at our sites when using simple/basic 
authentication instead of kerberos, neither regarding kerberos tickets, nor 
regarding apache server timeout.

Best regards

> silent incomplete checkout with Kerberos timeout
> ------------------------------------------------
>                 Key: SVN-4641
>                 URL: https://issues.apache.org/jira/browse/SVN-4641
>             Project: Subversion
>          Issue Type: Bug
>          Components: cmdline client
>    Affects Versions: 1.8.8, 1.9.4
>         Environment: Server is Debian GNU/Linux 8, Apache 2.4, using either 
> old SVN 1.8.10 and also when cleanly upgraded to 1.9.4 (using completely 
> newly created svn repo), supporting Kerberos authentication, x86_64.
> Client is Windows 2008 R2 x86_64, svn cli 1.9.4, using Kerberos 
> authentication.
> Kerberos Tickets are valid for 5 minutes.
> Checkout takes much longer than 5 minutes.
>            Reporter: Tim-Christian Bloss
>            Priority: Critical
>              Labels: performance, security, windows
> When checking out by svn CLI using Kerberos tickes for authentication and 
> checkout takes more than 5 minutes (time that Kerberos tickets are valid), 
> then the checkout ends with state "success" (return code 0) but all files 
> which could not be fetched within the validity duration of the Kerberos 
> ticket are missing.
> SVN also does not seem to print any warnings or information regarding this 
> issue we could automatically react on.
> This leads to supposedly successfull checkouts but builds do fail due to 
> missing resources.
> Example: Large maven project structure of 200+ submodules (yes we know it's 
> "not nice", but there's no chance to change this!), checkout takes about 15 
> minutes, but after 5 minutes checkout end with state "success", but two 
> thirds of data volume do not get checked out, including the main pom.xml.
> The same checkout using Debign GNU/Linux 8 x86_64 with cli 1.9.4 and basic 
> authentication works correct, checking all files out, taking the full 
> expected 15 minutes for the checkout.

This message was sent by Atlassian JIRA

Reply via email to