Question: Is RequestServiceTicket.CanCacheTickets condition too restrictive ?
- Dominant language
- C#
- Stars
- 567
- Forks
- 109
- PR merge metrics
- No merged PRs in 30d
Description
in this PR https://github.com/dotnet/Kerberos.NET/pull/249 `CanCacheTickets` property was introduced in order to fix issue https://github.com/dotnet/Kerberos.NET/issues/248
```csharp
public bool CanCacheTicket => this.CacheTicket ?? true &&
string.IsNullOrWhiteSpace(this.S4uTarget) && // is this line needed ?
this.S4uTicket == null &&
this.S4uTargetCertificate == null;
```
But when we pass string `s4u` to `GetServiceTicket` - it looks like tickets can be cached - because `s4u` goes to `Container` string parameter in `TicketCacheEntry` and allows to correctly identify record in cache.
It will not break the test case described in https://github.com/dotnet/Kerberos.NET/issues/248
In our case we are calling http service from backend service on behalf of the user in many parallel threads - every call to `GetServiceTicket(..., s4u: username)` goes to KDC (because ticket for user is not cached) and we running out of SocketPool in case of many threads (even if TcpKerberosTransport.MaxPoolSize increased).
We have workarounds on this: locking call to GetServiceTicket or using SemaphoreSlim(TcpKerberosTransport.MaxPoolSize,TcpKerberosTransport.MaxPoolSize) before it ... but it looks too rude
Contributor guide
Assessment
This issue has not been assessed yet.