Simon Wilkinson wrote:
On 15 Apr 2008, at 19:19, Quanah Gibson-Mount wrote:
As for the credential expiration issue, as far as I'm aware, the MIT folks have no desire to change how things behave now. If you don't want to deal with the problem, use a cyrus-sasl linked against Heimdal instead of MIT on your OpenLDAP servers.
Unfortunately, I think OpenLDAP needs to fix this problem. Continuing to use a connection past the lifetime of its security context is a bug.
As explained previously on this list, it's a difference in philosophy, not a bug. Heimdal and OpenLDAP follow the Unix philosophy - permission checking is done upon first access to a resource. Once you obtain access to the resource, it's yours until you give it up, no matter what other subsequent permission changes occur while you're using it. You may not like this behavior, but it's consistent and predictable.
You might argue that the MIT approach is more correct, but I would say that it's highly inconsistent, and inconsistency is highly undesirable in a security mechanism. For instance, by your thinking, if you decide that security contexts must all be invalidated whenever and wherever they are changed, then you also need to close all connections whenever somebody changes their password, because any sessions established with the old password must now be considered invalid. The fact that MIT Kerberos doesn't do this should be considered an inconsistency in their implementation, and a security bug.
Ultimately I think the MIT implementation reflects muddy thinking, at multiple levels.
Just because Heimdal currently permits it doesn't make it any less of a bug, and if Heimdal fixes its behaviour, OpenLDAP will break. Given that SASL has no way of renegotiating a connection, OpenLDAP needs to detect the connection failure, and close and reopen the connection.
I keep thinking about fixing this - at the moment, we just restart our slave slapds just before their credentials expire.
Cheers,
Simon.