KCM erroneously changes primary cache when renewing credentials

[qralston]

I work on multiple systems in multiple domains, so whenever I start my workday, I knit to acquire all of the credentials I need:

• user1@DOMAIN1.EXAMPLE.ORG
• user2@DOMAIN1.EXAMPLE.ORG
• user3@DOMAIN1.EXAMPLE.ORG
• user1@DOMAIN2.EXAMPLE.ORG
• user2@DOMAIN2.EXAMPLE.ORG
• user3@DOMAIN2.EXAMPLE.ORG
• user1@DOMAIN3.EXAMPLE.ORG
• user2@DOMAIN3.EXAMPLE.ORG
• user1@DOMAIN4.EXAMPLE.ORG

I have the sssd krb5_renew_interval option set to 1h, which enables KCM ticket renewal. I will also periodically renew tickets myself. (E.g., if I am finishing up work for the day, if I am working on my laptop, before I close its lid to suspend it, I will renew all of my credentials, so that they don’t expire overnight when the laptop is suspended and KCM cannot renew them.)

The main domain I work in is user1@DOMAIN1.EXAMPLE.ORG, so whenever I kinit, I always run kswitch -p user1@DOMAIN1.EXAMPLE.ORG to switch the primary cache back to user1@DOMAIN1.EXAMPLE.ORG. E.g.:

$ klist
Ticket cache: KCM:116201957:35652
Default principal: user1@DOMAIN1.EXAMPLE.ORG

Valid starting       Expires              Service principal
2022-09-20 10:11:45  2022-09-21 10:11:37  krbtgt/DOMAIN1.EXAMPLE.ORG@DOMAIN1.EXAMPLE.ORG
        renew until 2022-09-27 10:11:37

But: if KCM renews credentials, it will leave the primary cache set to an arbitrary credential—likely (I suspect) the last credential it renewed. So after a while, I can run klist again and see (e.g.):

$ klist
Ticket cache: KCM:116201957:56094
Default principal: user3@DOMAIN2.EXAMPLE.ORG

Valid starting       Expires              Service principal
2022-09-20 15:11:45  2022-09-21 15:11:37  krbtgt/DOMAIN2.EXAMPLE.ORG@DOMAIN2.EXAMPLE.ORG
        renew until 2022-09-27 15:11:37

Having KCM silently switch the primary cache underneath me breaks workflows. For example, one of the reasons why I set user1@DOMAIN1.EXAMPLE.ORG as the primary cache is because I interact with internal web sites that perform GSSAPI authentication using that credential. And when KCM switches the default credential out from underneath me, it breaks my interaction with those web sites.

This is an error. It is a welcome feature that KCM can automatically renew credentials in the cache, but KCM must restore the correct primary cache after it performs its renewal operations. From the user’s perspective, KCM must not change the primary cache.

I see this behavior on the latest RHEL9 sssd, sssd-2.6.2-4.el9_0.1.

[alexey-tikhonov]

RHBZs:

• https://bugzilla.redhat.com/show_bug.cgi?id=2143925
• https://bugzilla.redhat.com/show_bug.cgi?id=2166943

[aplopez]

It seems @justin-stephenson was right in his analysis:
https://bugzilla.redhat.com/show_bug.cgi?id=2143925#c14

In other words, his analysis looks right to me and it worked when I tried it.

[pbrezina]

Pushed PR: #6632

• master
  • 55e27a4 - KCM: Switch default caches only when there is no current default.
• sssd-2-8
  • 767234a - KCM: Switch default caches only when there is no current default.