SSSD / sssd

#2422 Optimize validation away when FAST channel is used
Closed: wontfix by pbrezina. Opened by simo.

Closed: wontfix
Reopen Issue

Validation is used to verify that the KDC we have been just auithenticated against is the real KDC and not a fake. When (keytab based) FAST channel are used, we already implicitly validated that the KDC on the other side is valid because it can see the communication in the FAST channel.
In this case validation is redundant and adds only one more roundtrip to the KDC.
We should skip validation if we have a pre-authenticated secure channel to the KDC to avoid adding unnecessary rountrip and latency during authentication.

This ticket might be implemented as part of #2370

Keep in mind that PAC is extracted during validation, we must not lose the functionality.

Fields changed

milestone: NEEDS_TRIAGE => SSSD 1.13 beta

Fields changed

mark: => 0

Fields changed

rhbz: => todo

Nice to have.

milestone: SSSD 1.13 beta => SSSD 1.13 backlog
priority: major => minor

Mass-moving tickets not planned for the next two releases.

Please reply with a comment if you disagree about the move..

milestone: SSSD 1.13 backlog => SSSD 1.15 beta

Metadata Update from @simo:
- Issue set to the milestone: SSSD Future releases (no date set yet)

Metadata Update from @thalman:
- Custom field design_review reset (from 0)
- Custom field mark reset (from 0)
- Custom field patch reset (from 0)
- Custom field review reset (from 0)
- Custom field testsupdated reset (from 0)
- Issue close_status updated to: None
- Issue tagged with: Canditate to close

Thank you for taking time to submit this request for SSSD. Unfortunately this issue was not given priority and the team lacks the capacity to work on it at this time.

Given that we are unable to fulfill this request I am closing the issue as wontfix.

If the issue still persist on recent SSSD you can request re-consideration of this decision by reopening this issue. Please provide additional technical details about its importance to you.

Thank you for understanding.

Metadata Update from @pbrezina:
- Issue close_status updated to: wontfix
- Issue status updated to: Closed (was: Open)

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/3464

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None

Candidate to close

None
None
High
false
false
false
false
enhancement
SSSD
1.12.0
todo
false
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.