gssproxy

#62 Adapt to the way libkrb5 kinit deals with or ignores clock skew
Closed: Invalid Opened by gd.

Closed: Invalid
Reopen Issue

Currently interposetest can fail when gssproxy is used and running and if the KDC time is out of sync with the client time:

./interposetest -t host
Acquiring for: host/mthelena.ipadom.ber.redhat.com@
SERVER line 594: gssproxy returned an error: 851968
Failed with: Unspecified GSS failure. Minor code may provide more information, Clock skew too great
CLIENT line 254: Failed to receive data from server!

We need to adapt to the way a pure kinit or TGS-REQ deals with clock skew since the changes in recent MIT kerberos libraries.

I don't think there is anything we can do here.
The clock skew detection and correction in libkrb5 works only for clients, but he contacted service need to have the clock in sync or will fail anyways.
Interposetest is both a client and a server application, so it will always fail when the clock is completely off compared to the KDC.

Closing.

Metadata Update from @gd:
- Issue assigned to simo
- Issue set to the milestone: X - DEFERRED
Metadata
None
None
None
Normal
task
gssproxy daemon
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.