[Freeipa-devel] [PATCH 64] Implement password based session login

[John Dennis]

On 02/26/2012 04:40 PM, Rob Crittenden wrote:
> John Dennis wrote:
>> On 02/26/2012 03:54 PM, John Dennis wrote:
>>> I assume you're running the script I attached. The reason why you keep
>>> getting new sessions is because the script does not send the previous
>>> cookie back, from the server's perspective these all appear to be new
>>> login requests. Sessions are not tracked by user, they are tracked by
>>> session id.
>>
>> I should have added that if this was being invoked from the browser UI
>> like it is intended to be the cookie would be retransmitted by the
>> browser and you wouldn't see this behavior. I think what you're seeing
>> is an artifact of the clumsy way I cobbled together a test since we
>> don't have a UI yet. But I will verify this in a little while.
>>
>
> I would have expected to have gotten a brand new session with each
> request and yet it seems to be associating existing sessions as well.
>
> I'm fine with a new session each time but otherwise this could leak data.

I reproduced the problem you were seeing, but in the middle of debugging 
it I got stuck because my vm is flaking out. All of sudden I'm getting 
errors about files missing, no space on device, etc. Yet df shows I've 
got plenty of space. I rebooted but it didn't help. Either something is 
very wrong all of a sudden on my vm or something is wrong on it's host. 
But I'll have to pick this up tomorrow.

-- 
John Dennis <jdennis at redhat.com>

Looking to carve out IT costs?
www.redhat.com/carveoutcosts/