From ad2a90543a2f76dd61c9f6f3948a6895f7f9d930 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek@redhat.com>
Date: Wed, 19 Jul 2017 17:00:11 +0200
Subject: [PATCH] KRB5: Only ignore offline notification when using KDC proxy
 once

---
 src/providers/krb5/krb5_auth.c | 4 +++-
 src/providers/krb5/krb5_auth.h | 1 +
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c
index 03ea9d88cac67919d4b9ba3a1cf2efa208662195..915891255828920e1e9a1918d765c4fdce8a19a7 100644
--- a/src/providers/krb5/krb5_auth.c
+++ b/src/providers/krb5/krb5_auth.c
@@ -791,10 +791,12 @@ static void krb5_auth_resolve_done(struct tevent_req *subreq)
 
     if (kr->is_offline
             && sss_krb5_realm_has_proxy(dp_opt_get_cstring(kr->krb5_ctx->opts,
-                                        KRB5_REALM))) {
+                                        KRB5_REALM))
+            && kr->kdcproxy_faux_online == false) {
         DEBUG(SSSDBG_TRACE_FUNC,
               "Resetting offline status, KDC proxy is in use\n");
         kr->is_offline = false;
+        kr->kdcproxy_faux_online = true;
     }
 
     subreq = handle_child_send(state, state->ev, kr);
diff --git a/src/providers/krb5/krb5_auth.h b/src/providers/krb5/krb5_auth.h
index 8ad3aeff21e58f9055ae144eaa450992c6391ba6..a13e26020d7e1ea0aeb17bd77155497af136ed0d 100644
--- a/src/providers/krb5/krb5_auth.h
+++ b/src/providers/krb5/krb5_auth.h
@@ -59,6 +59,7 @@ struct krb5child_req {
     uid_t uid;
     gid_t gid;
     bool is_offline;
+    bool kdcproxy_faux_online;
     struct fo_server *srv;
     struct fo_server *kpasswd_srv;
     bool active_ccache;
-- 
2.9.4