Simon Wilkinson wrote:
On 15 Apr 2008, at 19:19, Quanah Gibson-Mount wrote:
As for the credential expiration issue, as far as I'm aware, the
MIT folks have no desire to change how things behave now. If you
don't want to deal with the problem, use a cyrus-sasl linked
against Heimdal instead of MIT on your OpenLDAP servers.
Unfortunately, I think OpenLDAP needs to fix this problem. Continuing
to use a connection past the lifetime of its security context is a
bug.
As explained previously on this list, it's a difference in philosophy, not a
bug. Heimdal and OpenLDAP follow the Unix philosophy - permission checking is
done upon first access to a resource. Once you obtain access to the resource,
it's yours until you give it up, no matter what other subsequent permission
changes occur while you're using it. You may not like this behavior, but it's
consistent and predictable.
You might argue that the MIT approach is more correct, but I would say that
it's highly inconsistent, and inconsistency is highly undesirable in a
security mechanism. For instance, by your thinking, if you decide that
security contexts must all be invalidated whenever and wherever they are
changed, then you also need to close all connections whenever somebody changes
their password, because any sessions established with the old password must
now be considered invalid. The fact that MIT Kerberos doesn't do this should
be considered an inconsistency in their implementation, and a security bug.
Ultimately I think the MIT implementation reflects muddy thinking, at multiple
levels.
Just because Heimdal currently permits it doesn't make it any
less of a bug, and if Heimdal fixes its behaviour, OpenLDAP will
break. Given that SASL has no way of renegotiating a connection,
OpenLDAP needs to detect the connection failure, and close and reopen
the connection.
I keep thinking about fixing this - at the moment, we just restart
our slave slapds just before their credentials expire.
Cheers,
Simon.
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/
