[19800] in Kerberos_V5_Development

home help back first fref pref prev next nref lref last post

Re: Aggressive kinit timeouts

daemon@ATHENA.MIT.EDU (Greg Hudson)
Tue Aug 7 10:16:20 2018

To: Jonathan Maron <jonathan.maron@oracle.com>,
        "krbdev@mit.edu" <krbdev@mit.edu>
From: Greg Hudson <ghudson@mit.edu>
Message-ID: <3793b18c-4682-6449-6af3-e97603c9d94b@mit.edu>
Date: Tue, 7 Aug 2018 10:15:57 -0400
MIME-Version: 1.0
In-Reply-To: <F52C0A57-62CB-4C75-ABD5-4B015ADD169B@oracle.com>
Content-Language: en-US
Content-Type: text/plain; charset="utf-8"
Errors-To: krbdev-bounces@mit.edu
Content-Transfer-Encoding: 8bit

Please use kerberos@mit.edu for operational questions like this.  For 
simplicity I will go ahead and answer here.

On 08/07/2018 06:46 AM, Jonathan Maron wrote:
>    We have an LDAP realm setup that doesn’t communicate with a local LDAP DB, but rather goes through a number of gateways to access a remote LDAP resource.  This introduces some latency that at times exceeds 1 second.  That appears to be an issue - we often see authentication failures, possibly since the order of responses for repeated AS_REQ may be out of order?  Anyhow, we are definitely seeing auth failures, and the 1 second timeout appears to play a role.

I'm not sure how out-of-order responses could account for the problem. 
After one second, the client retransmits or tries a different KDC, but 
neither request should result in a failure.

>    We are unfortunately still using version 1.10.  Has this issue been addressed in subsequent versions?  Is the 1 second timeout now configurable?

It's not configurable, but as of 1.12, if you use TCP, the client waits 
ten seconds before moving on if the KDC accepts the TCP connection 
within one second.  You can use "udp_preference_limit = 0" in 
[libdefaults] to force the initial use of TCP.
krbdev mailing list             krbdev@mit.edu

home help back first fref pref prev next nref lref last post