Sailesh Mukil has posted comments on this change. Change subject: KUDU-1845: Kerberos client keytab should be periodically renewed ......................................................................
Patch Set 7: (2 comments) http://gerrit.cloudera.org:8080/#/c/5820/6/src/kudu/security/init.cc File src/kudu/security/init.cc: PS6, Line 189: if (krb5_init_context(&krb5_ctx_) != 0) { : return Status::RuntimeError("could not initialize krb5 library"); > I'm not sure this is accomplishing what we want. Doesn't this just end up w You're right. I looked at the krb5 code and this call just returns the handle to the old ccache. As we spoke, the only known workaround to this is to not renew the tickets and just reacquire the tickets every time. I've removed the renewal code, and just left the reacquire code. However, this race still exists when using Heimdal's krb5 and there's no workaround for that. I've left a comment explaining that. Line 248: KRB5_RETURN_NOT_OK_PREPEND(krb5_cc_store_cred(krb5_ctx_, ccache_, &creds), > isn't it possible that the renewal time changes when we renew the ticket? m How so? The renewal time is based off the 'ticket_lifetime' which is a config value in krb5.conf. So 'endtime - now' will always be the same assuming 'now' is the 'start_time' which it almost always will be. Are you talking about the case where someone changes that value in the conf file midway? -- To view, visit http://gerrit.cloudera.org:8080/5820 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-MessageType: comment Gerrit-Change-Id: Ic4c072c1210216369e60eac88be4a20d9b166b2d Gerrit-PatchSet: 7 Gerrit-Project: kudu Gerrit-Branch: master Gerrit-Owner: Sailesh Mukil <[email protected]> Gerrit-Reviewer: Adar Dembo <[email protected]> Gerrit-Reviewer: Kudu Jenkins Gerrit-Reviewer: Sailesh Mukil <[email protected]> Gerrit-Reviewer: Tidy Bot Gerrit-Reviewer: Todd Lipcon <[email protected]> Gerrit-HasComments: Yes
