[594] in Info-AFS_Redistribution
Patches for XDM for AFS authentication
daemon@ATHENA.MIT.EDU (Scanner)
Tue Feb 11 14:42:28 1992
To: info-afs@transarc.com
Date: Tue, 11 Feb 92 13:54:56 EST
From: Scanner <lucee@rpi.edu>
For a while at RPI we have been running a modified version of xdm on
our Sun's which uses the ka_UserAuthenticate() call to verify and
authenticate a user.
We also have a number of XStations serving off of RS/6000's. However
we have not been able to use xdm to control these Xstations because of
a rather annoying an untraceable problem.
I'm not sure if this is a problem which this group can help me with or
if I should file a problem with Transarc.
The symptoms are this:
We call ka_UserAuthenticate() with the usual arguments and we also
tell it to create a PAG with the authentication.
Now, on Sun's this has always worked fine. On RS/6000's it will tend
to work for about two days (it seems to depend on how many times
people sign on to a machine)..
All of the sudden, the authentication will stop working. XDM calls
ka_UserAuthenticate(), it returns saying that the password and user
name were verified, but does not put the user in a PAG. Since this
call occurs as root, root ends up with the user's tokens.
We tried separating out the setpag() functionality so that instead of
doing the SETPAG flag in ka_UserAuthenticate() we'd have xdm create a
new PAG when it forked to manage a given display.
Same results. You log in not in a PAG and root has your tokens. Since
the xdm process on an rs/6000 is managing a number of Xstations
(usually at least six), we can't just run xdm under a single PAG.
Again the most annoying part of this is that it works fine, for a
little while (usually two days, sometimes as long as two weeks), then
conks out. This is very frustrating and making sensical debugging
difficult.
Does anyone have any idea why setpag() is failing on RS/6000's after a
certain amount of time?
Note that if I just call the "pagsh" program, I still end up in a PAG.
If I were to hazard a guess it looks like there is some sort of
limitation, or finite resource for PAG's, and that after a certain
process group (or something) calls setpag() a number of times, it
simply will not be given any more PAGs. (Yes, people are unloged after
they log out.)
The way xdm runs, for those of you who don't know, is that it has a
central process. This central process will fork for each display that
it manages. What I have done is that when it forks, it calls
setpag().
I keep feeling that I'm missing something extremely obvious, but at
this point I'm at a loss for what that may be. Times like this I
really wish that the Authentication Server programing specifications
had been released (of all the ones that were released that is the
single one that I need the most)
Any ideas?
Any help will be greatly appreciated.
--Scanner (scanner@rpi.edu)
