dotnet / dotnet/Kerberos.NET

Question: Is RequestServiceTicket.CanCacheTickets condition too restrictive ?

Open
#383 2 comments 1 reaction 0 assignees View on GitHub
Dominant language
C#
Stars
567
Forks
109
PR merge metrics
No merged PRs in 30d

Description

in this PR https://github.com/dotnet/Kerberos.NET/pull/249 `CanCacheTickets` property was introduced in order to fix issue https://github.com/dotnet/Kerberos.NET/issues/248

```csharp
public bool CanCacheTicket => this.CacheTicket ?? true &&
string.IsNullOrWhiteSpace(this.S4uTarget) && // is this line needed ?
this.S4uTicket == null &&
this.S4uTargetCertificate == null;
```

But when we pass string `s4u` to `GetServiceTicket` - it looks like tickets can be cached - because `s4u` goes to `Container` string parameter in `TicketCacheEntry` and allows to correctly identify record in cache.

It will not break the test case described in https://github.com/dotnet/Kerberos.NET/issues/248

In our case we are calling http service from backend service on behalf of the user in many parallel threads - every call to `GetServiceTicket(..., s4u: username)` goes to KDC (because ticket for user is not cached) and we running out of SocketPool in case of many threads (even if TcpKerberosTransport.MaxPoolSize increased).

We have workarounds on this: locking call to GetServiceTicket or using SemaphoreSlim(TcpKerberosTransport.MaxPoolSize,TcpKerberosTransport.MaxPoolSize) before it ... but it looks too rude

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.