Blame SOURCES/0023-krb5-Lookahead-resolving-of-host-names.patch

841ac7
From 385c8c7e0e6f184dd61953745bfe04a5a79a951a Mon Sep 17 00:00:00 2001
841ac7
From: Tomas Halman <thalman@redhat.com>
841ac7
Date: Fri, 15 Mar 2019 10:27:50 +0100
841ac7
Subject: [PATCH 23/23] krb5: Lookahead resolving of host names
841ac7
841ac7
The caller that initializes
841ac7
the fail over service (maybe with be_fo_add_service) should provide
841ac7
a hint with the value of the lookahead option. Then, if a request for
841ac7
server resolution is triggered, the fail over code would resolve a server
841ac7
and afterwards check if enough fo_server entries with a valid hostname
841ac7
in the struct server_common structure. If not, the request would
841ac7
check if any of the fo_server structures represents a SRV query and
841ac7
try to resolve the query to receive more host names.
841ac7
841ac7
Resolves:
841ac7
https://pagure.io/SSSD/sssd/issue/3975
841ac7
841ac7
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
841ac7
(cherry picked from commit e8d806d9bbb1ba288ed6a83158113f4d8f8a8929)
841ac7
---
841ac7
 Makefile.am                               |  1 +
841ac7
 src/man/sssd-krb5.5.xml                   | 34 +++++++++++
841ac7
 src/providers/ad/ad_common.c              | 10 +++-
841ac7
 src/providers/ad/ad_common.h              |  2 +
841ac7
 src/providers/ad/ad_init.c                |  2 +
841ac7
 src/providers/ad/ad_opts.c                |  2 +
841ac7
 src/providers/ad/ad_subdomains.c          | 12 +++-
841ac7
 src/providers/ipa/ipa_common.c            | 14 +++--
841ac7
 src/providers/ipa/ipa_opts.c              |  2 +
841ac7
 src/providers/ipa/ipa_subdomains.c        |  4 +-
841ac7
 src/providers/ipa/ipa_subdomains_server.c |  7 +++
841ac7
 src/providers/krb5/krb5_common.c          | 71 ++++++++++++++++++++++-
841ac7
 src/providers/krb5/krb5_common.h          | 13 ++++-
841ac7
 src/providers/krb5/krb5_init.c            | 19 +++++-
841ac7
 src/providers/krb5/krb5_opts.c            |  1 +
841ac7
 src/providers/ldap/ldap_common.c          |  9 +++
841ac7
 src/providers/ldap/ldap_opts.c            |  1 +
841ac7
 src/providers/ldap/sdap.h                 |  1 +
841ac7
 18 files changed, 193 insertions(+), 12 deletions(-)
841ac7
841ac7
diff --git a/Makefile.am b/Makefile.am
841ac7
index e22423071..0c24ae664 100644
841ac7
--- a/Makefile.am
841ac7
+++ b/Makefile.am
841ac7
@@ -3339,6 +3339,7 @@ test_ad_subdom_LDADD = \
841ac7
     libsss_idmap.la \
841ac7
     libsss_test_common.la \
841ac7
     libdlopen_test_providers.la \
841ac7
+    libsss_krb5_common.la \
841ac7
     $(NULL)
841ac7
 
841ac7
 test_ipa_subdom_util_SOURCES = \
841ac7
diff --git a/src/man/sssd-krb5.5.xml b/src/man/sssd-krb5.5.xml
841ac7
index 60b7dfb50..5a0bb5e9c 100644
841ac7
--- a/src/man/sssd-krb5.5.xml
841ac7
+++ b/src/man/sssd-krb5.5.xml
841ac7
@@ -501,6 +501,40 @@
841ac7
                     </listitem>
841ac7
                 </varlistentry>
841ac7
 
841ac7
+                <varlistentry>
841ac7
+                    <term>krb5_kdcinfo_lookahead (string)</term>
841ac7
+                    <listitem>
841ac7
+                        <para>
841ac7
+                            When krb5_use_kdcinfo is set to true, you can limit the amount
841ac7
+                            of servers handed to
841ac7
+                            <citerefentry>
841ac7
+                                <refentrytitle>sssd_krb5_locator_plugin</refentrytitle>
841ac7
+                                <manvolnum>8</manvolnum>
841ac7
+                            </citerefentry>.
841ac7
+                            This might be helpful when there are too many servers
841ac7
+                            discovered using SRV record.
841ac7
+                        </para>
841ac7
+                        <para>
841ac7
+                            The krb5_kdcinfo_lookahead option contains two
841ac7
+                            numbers seperated by a colon. The first number represents
841ac7
+                            number of primary servers used and the second number
841ac7
+                            specifies the number of backup servers.
841ac7
+                        </para>
841ac7
+                        <para>
841ac7
+                            For example <emphasis>10:0</emphasis> means that up to
841ac7
+                            10 primary servers will be handed to
841ac7
+                            <citerefentry>
841ac7
+                                <refentrytitle>sssd_krb5_locator_plugin</refentrytitle>
841ac7
+                                <manvolnum>8</manvolnum>
841ac7
+                            </citerefentry>.
841ac7
+                            but no backup servers.
841ac7
+                        </para>
841ac7
+                        <para>
841ac7
+                            Default: 3:1
841ac7
+                        </para>
841ac7
+                    </listitem>
841ac7
+                </varlistentry>
841ac7
+
841ac7
                 <varlistentry>
841ac7
                     <term>krb5_use_enterprise_principal (boolean)</term>
841ac7
                     <listitem>
841ac7
diff --git a/src/providers/ad/ad_common.c b/src/providers/ad/ad_common.c
841ac7
index b7f34daa9..4d1800806 100644
841ac7
--- a/src/providers/ad/ad_common.c
841ac7
+++ b/src/providers/ad/ad_common.c
841ac7
@@ -729,6 +729,8 @@ ad_failover_init(TALLOC_CTX *mem_ctx, struct be_ctx *bectx,
841ac7
                  const char *ad_gc_service,
841ac7
                  const char *ad_domain,
841ac7
                  bool use_kdcinfo,
841ac7
+                 size_t n_lookahead_primary,
841ac7
+                 size_t n_lookahead_backup,
841ac7
                  struct ad_service **_service)
841ac7
 {
841ac7
     errno_t ret;
841ac7
@@ -760,7 +762,9 @@ ad_failover_init(TALLOC_CTX *mem_ctx, struct be_ctx *bectx,
841ac7
 
841ac7
     service->krb5_service = krb5_service_new(service, bectx,
841ac7
                                              ad_service, krb5_realm,
841ac7
-                                             use_kdcinfo);
841ac7
+                                             use_kdcinfo,
841ac7
+                                             n_lookahead_primary,
841ac7
+                                             n_lookahead_backup);
841ac7
     if (!service->krb5_service) {
841ac7
         ret = ENOMEM;
841ac7
         goto done;
841ac7
@@ -1292,6 +1296,10 @@ ad_get_auth_options(TALLOC_CTX *mem_ctx,
841ac7
     DEBUG(SSSDBG_CONF_SETTINGS, "Option %s set to %s\n",
841ac7
           krb5_options[KRB5_USE_KDCINFO].opt_name,
841ac7
           ad_opts->service->krb5_service->write_kdcinfo ? "true" : "false");
841ac7
+    sss_krb5_parse_lookahead(
841ac7
+        dp_opt_get_string(krb5_options, KRB5_KDCINFO_LOOKAHEAD),
841ac7
+        &ad_opts->service->krb5_service->lookahead_primary,
841ac7
+        &ad_opts->service->krb5_service->lookahead_backup);
841ac7
 
841ac7
     *_opts = talloc_steal(mem_ctx, krb5_options);
841ac7
 
841ac7
diff --git a/src/providers/ad/ad_common.h b/src/providers/ad/ad_common.h
841ac7
index 529753a8a..638465958 100644
841ac7
--- a/src/providers/ad/ad_common.h
841ac7
+++ b/src/providers/ad/ad_common.h
841ac7
@@ -147,6 +147,8 @@ ad_failover_init(TALLOC_CTX *mem_ctx, struct be_ctx *ctx,
841ac7
                  const char *ad_gc_service,
841ac7
                  const char *ad_domain,
841ac7
                  bool use_kdcinfo,
841ac7
+                 size_t n_lookahead_primary,
841ac7
+                 size_t n_lookahead_backup,
841ac7
                  struct ad_service **_service);
841ac7
 
841ac7
 errno_t
841ac7
diff --git a/src/providers/ad/ad_init.c b/src/providers/ad/ad_init.c
841ac7
index 637efb761..612d4587e 100644
841ac7
--- a/src/providers/ad/ad_init.c
841ac7
+++ b/src/providers/ad/ad_init.c
841ac7
@@ -160,6 +160,8 @@ static errno_t ad_init_options(TALLOC_CTX *mem_ctx,
841ac7
                            ad_realm, AD_SERVICE_NAME, AD_GC_SERVICE_NAME,
841ac7
                            dp_opt_get_string(ad_options->basic, AD_DOMAIN),
841ac7
                            false, /* will be set in ad_get_auth_options() */
841ac7
+                           (size_t) -1,
841ac7
+                           (size_t) -1,
841ac7
                            &ad_options->service);
841ac7
     if (ret != EOK) {
841ac7
         DEBUG(SSSDBG_FATAL_FAILURE, "Failed to init AD failover service: "
841ac7
diff --git a/src/providers/ad/ad_opts.c b/src/providers/ad/ad_opts.c
841ac7
index c408295f3..652d8bb27 100644
841ac7
--- a/src/providers/ad/ad_opts.c
841ac7
+++ b/src/providers/ad/ad_opts.c
841ac7
@@ -111,6 +111,7 @@ struct dp_option ad_def_ldap_opts[] = {
841ac7
     { "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING },
841ac7
     { "krb5_canonicalize", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
841ac7
     { "krb5_use_kdcinfo", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
841ac7
+    { "krb5_kdcinfo_lookahead", DP_OPT_STRING, NULL_STRING, NULL_STRING },
841ac7
     { "ldap_pwd_policy", DP_OPT_STRING, { "none" }, NULL_STRING },
841ac7
     { "ldap_referrals", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
841ac7
     { "account_cache_expiration", DP_OPT_NUMBER, { .number = 0 }, NULL_NUMBER },
841ac7
@@ -175,6 +176,7 @@ struct dp_option ad_def_krb5_opts[] = {
841ac7
     { "krb5_canonicalize", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
841ac7
     { "krb5_use_enterprise_principal", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
841ac7
     { "krb5_use_kdcinfo", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
841ac7
+    { "krb5_kdcinfo_lookahead", DP_OPT_STRING, NULL_STRING, NULL_STRING },
841ac7
     { "krb5_map_user", DP_OPT_STRING, NULL_STRING, NULL_STRING },
841ac7
     DP_OPTION_TERMINATOR
841ac7
 };
841ac7
diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c
841ac7
index 4fc4be094..b4ad347e4 100644
841ac7
--- a/src/providers/ad/ad_subdomains.c
841ac7
+++ b/src/providers/ad/ad_subdomains.c
841ac7
@@ -280,6 +280,8 @@ ad_subdom_ad_ctx_new(struct be_ctx *be_ctx,
841ac7
     const char *keytab;
841ac7
     char *subdom_conf_path;
841ac7
     bool use_kdcinfo = false;
841ac7
+    size_t n_lookahead_primary = SSS_KRB5_LOOKAHEAD_PRIMARY_DEFAULT;
841ac7
+    size_t n_lookahead_backup = SSS_KRB5_LOOKAHEAD_BACKUP_DEFAULT;
841ac7
 
841ac7
     realm = dp_opt_get_cstring(id_ctx->ad_options->basic, AD_KRB5_REALM);
841ac7
     hostname = dp_opt_get_cstring(id_ctx->ad_options->basic, AD_HOSTNAME);
841ac7
@@ -331,6 +333,11 @@ ad_subdom_ad_ctx_new(struct be_ctx *be_ctx,
841ac7
             && id_ctx->ad_options->auth_ctx->opts != NULL) {
841ac7
         use_kdcinfo = dp_opt_get_bool(id_ctx->ad_options->auth_ctx->opts,
841ac7
                                       KRB5_USE_KDCINFO);
841ac7
+        sss_krb5_parse_lookahead(
841ac7
+            dp_opt_get_string(id_ctx->ad_options->auth_ctx->opts,
841ac7
+                              KRB5_KDCINFO_LOOKAHEAD),
841ac7
+            &n_lookahead_primary,
841ac7
+            &n_lookahead_backup);
841ac7
     }
841ac7
 
841ac7
     DEBUG(SSSDBG_TRACE_ALL,
841ac7
@@ -339,7 +346,10 @@ ad_subdom_ad_ctx_new(struct be_ctx *be_ctx,
841ac7
 
841ac7
     ret = ad_failover_init(ad_options, be_ctx, servers, backup_servers,
841ac7
                            subdom->realm, service_name, gc_service_name,
841ac7
-                           subdom->name, use_kdcinfo, &ad_options->service);
841ac7
+                           subdom->name, use_kdcinfo,
841ac7
+                           n_lookahead_primary,
841ac7
+                           n_lookahead_backup,
841ac7
+                           &ad_options->service);
841ac7
     if (ret != EOK) {
841ac7
         DEBUG(SSSDBG_OP_FAILURE, "Cannot initialize AD failover\n");
841ac7
         talloc_free(ad_options);
841ac7
diff --git a/src/providers/ipa/ipa_common.c b/src/providers/ipa/ipa_common.c
841ac7
index 1ed2e2203..871fb9bbc 100644
841ac7
--- a/src/providers/ipa/ipa_common.c
841ac7
+++ b/src/providers/ipa/ipa_common.c
841ac7
@@ -801,6 +801,12 @@ int ipa_get_auth_options(struct ipa_options *ipa_opts,
841ac7
     DEBUG(SSSDBG_CONF_SETTINGS, "Option %s set to %s\n",
841ac7
           ipa_opts->auth[KRB5_USE_KDCINFO].opt_name,
841ac7
           ipa_opts->service->krb5_service->write_kdcinfo ? "true" : "false");
841ac7
+    if (ipa_opts->service->krb5_service->write_kdcinfo) {
841ac7
+        sss_krb5_parse_lookahead(
841ac7
+            dp_opt_get_string(ipa_opts->auth, KRB5_KDCINFO_LOOKAHEAD),
841ac7
+            &ipa_opts->service->krb5_service->lookahead_primary,
841ac7
+            &ipa_opts->service->krb5_service->lookahead_backup);
841ac7
+    }
841ac7
 
841ac7
     *_opts = ipa_opts->auth;
841ac7
     ret = EOK;
841ac7
@@ -1022,10 +1028,10 @@ int ipa_service_init(TALLOC_CTX *memctx, struct be_ctx *ctx,
841ac7
 
841ac7
     service->krb5_service = krb5_service_new(service, ctx,
841ac7
                                              "IPA", realm,
841ac7
-                                             true); /* The configured value
841ac7
-                                                     * will be set later when
841ac7
-                                                     * the auth provider is set up
841ac7
-                                                     */
841ac7
+                                             true,   /* The configured value */
841ac7
+                                             0,      /* will be set later when */
841ac7
+                                             0);     /* the auth provider is set up */
841ac7
+
841ac7
     if (!service->krb5_service) {
841ac7
         ret = ENOMEM;
841ac7
         goto done;
841ac7
diff --git a/src/providers/ipa/ipa_opts.c b/src/providers/ipa/ipa_opts.c
841ac7
index 373dc0e53..600b9ec4b 100644
841ac7
--- a/src/providers/ipa/ipa_opts.c
841ac7
+++ b/src/providers/ipa/ipa_opts.c
841ac7
@@ -121,6 +121,7 @@ struct dp_option ipa_def_ldap_opts[] = {
841ac7
     { "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING },
841ac7
     { "krb5_canonicalize", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
841ac7
     { "krb5_use_kdcinfo", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
841ac7
+    { "krb5_kdcinfo_lookahead", DP_OPT_STRING, NULL_STRING, NULL_STRING },
841ac7
     { "ldap_pwd_policy", DP_OPT_STRING, { "none" } , NULL_STRING },
841ac7
     { "ldap_referrals", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
841ac7
     { "account_cache_expiration", DP_OPT_NUMBER, { .number = 0 }, NULL_NUMBER },
841ac7
@@ -320,6 +321,7 @@ struct dp_option ipa_def_krb5_opts[] = {
841ac7
     { "krb5_canonicalize", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
841ac7
     { "krb5_use_enterprise_principal", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
841ac7
     { "krb5_use_kdcinfo", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
841ac7
+    { "krb5_kdcinfo_lookahead", DP_OPT_STRING, NULL_STRING, NULL_STRING },
841ac7
     { "krb5_map_user", DP_OPT_STRING, NULL_STRING, NULL_STRING },
841ac7
     DP_OPTION_TERMINATOR
841ac7
 };
841ac7
diff --git a/src/providers/ipa/ipa_subdomains.c b/src/providers/ipa/ipa_subdomains.c
841ac7
index da1279e3e..94365aaca 100644
841ac7
--- a/src/providers/ipa/ipa_subdomains.c
841ac7
+++ b/src/providers/ipa/ipa_subdomains.c
841ac7
@@ -692,7 +692,9 @@ ipa_subdom_get_k5_svc(struct ipa_subdomains_ctx *ctx,
841ac7
                                         ctx->be_ctx,
841ac7
                                         "IPA",
841ac7
                                         dom->realm,
841ac7
-                                        use_kdcinfo);
841ac7
+                                        use_kdcinfo,
841ac7
+                                        (size_t) -1,
841ac7
+                                        (size_t) -1);
841ac7
     if (k5svc_ent->k5svc == NULL) {
841ac7
         talloc_free(k5svc_ent);
841ac7
         return NULL;
841ac7
diff --git a/src/providers/ipa/ipa_subdomains_server.c b/src/providers/ipa/ipa_subdomains_server.c
841ac7
index 43a3053cb..dd0933642 100644
841ac7
--- a/src/providers/ipa/ipa_subdomains_server.c
841ac7
+++ b/src/providers/ipa/ipa_subdomains_server.c
841ac7
@@ -225,6 +225,8 @@ ipa_ad_ctx_new(struct be_ctx *be_ctx,
841ac7
     errno_t ret;
841ac7
     const char *extra_attrs;
841ac7
     bool use_kdcinfo = false;
841ac7
+    size_t n_lookahead_primary = (size_t)-1;
841ac7
+    size_t n_lookahead_backup = (size_t)-1;
841ac7
 
841ac7
     ad_domain = subdom->name;
841ac7
     DEBUG(SSSDBG_TRACE_LIBS, "Setting up AD subdomain %s\n", subdom->name);
841ac7
@@ -284,6 +286,10 @@ ipa_ad_ctx_new(struct be_ctx *be_ctx,
841ac7
     if (id_ctx->ipa_options != NULL && id_ctx->ipa_options->auth != NULL) {
841ac7
         use_kdcinfo = dp_opt_get_bool(id_ctx->ipa_options->auth,
841ac7
                                       KRB5_USE_KDCINFO);
841ac7
+        sss_krb5_parse_lookahead(
841ac7
+            dp_opt_get_string(id_ctx->ipa_options->auth, KRB5_KDCINFO_LOOKAHEAD),
841ac7
+            &n_lookahead_primary,
841ac7
+            &n_lookahead_backup);
841ac7
     }
841ac7
 
841ac7
     DEBUG(SSSDBG_TRACE_ALL,
841ac7
@@ -297,6 +303,7 @@ ipa_ad_ctx_new(struct be_ctx *be_ctx,
841ac7
                            subdom->realm,
841ac7
                            service_name, gc_service_name,
841ac7
                            subdom->name, use_kdcinfo,
841ac7
+                           n_lookahead_primary, n_lookahead_backup,
841ac7
                            &ad_options->service);
841ac7
     if (ret != EOK) {
841ac7
         DEBUG(SSSDBG_OP_FAILURE, "Cannot initialize AD failover\n");
841ac7
diff --git a/src/providers/krb5/krb5_common.c b/src/providers/krb5/krb5_common.c
841ac7
index 1e33fc0f5..e56820b8d 100644
841ac7
--- a/src/providers/krb5/krb5_common.c
841ac7
+++ b/src/providers/krb5/krb5_common.c
841ac7
@@ -390,6 +390,39 @@ done:
841ac7
     return ret;
841ac7
 }
841ac7
 
841ac7
+void sss_krb5_parse_lookahead(const char *param, size_t *primary, size_t *backup)
841ac7
+{
841ac7
+    int ret;
841ac7
+
841ac7
+    if (primary == NULL || backup == NULL) {
841ac7
+        return;
841ac7
+    }
841ac7
+
841ac7
+    *primary = SSS_KRB5_LOOKAHEAD_PRIMARY_DEFAULT;
841ac7
+    *backup = SSS_KRB5_LOOKAHEAD_BACKUP_DEFAULT;
841ac7
+
841ac7
+    if (param == NULL) {
841ac7
+        return;
841ac7
+    }
841ac7
+
841ac7
+    if (strchr(param, ':')) {
841ac7
+        ret = sscanf(param, "%zu:%zu", primary, backup);
841ac7
+        if (ret != 2) {
841ac7
+            DEBUG(SSSDBG_MINOR_FAILURE, "Could not parse krb5_kdcinfo_lookahead!\n");
841ac7
+        }
841ac7
+    } else {
841ac7
+        ret = sscanf(param, "%zu", primary);
841ac7
+        if (ret != 1) {
841ac7
+            DEBUG(SSSDBG_MINOR_FAILURE, "Could not parse krb5_kdcinfo_lookahead!\n");
841ac7
+        }
841ac7
+    }
841ac7
+
841ac7
+    DEBUG(SSSDBG_CONF_SETTINGS,
841ac7
+          "Option krb5_kdcinfo_lookahead set to %zu:%zu",
841ac7
+          *primary, *backup);
841ac7
+}
841ac7
+
841ac7
+
841ac7
 static int remove_info_files_destructor(void *p)
841ac7
 {
841ac7
     int ret;
841ac7
@@ -668,6 +701,13 @@ errno_t write_krb5info_file_from_fo_server(struct krb5_service *krb5_service,
841ac7
     int primary;
841ac7
     const char *address;
841ac7
     errno_t ret;
841ac7
+    size_t n_lookahead_primary;
841ac7
+    size_t n_lookahead_backup;
841ac7
+
841ac7
+    if (krb5_service == NULL) {
841ac7
+        DEBUG(SSSDBG_CRIT_FAILURE, "The krb5_service must not be NULL!\n");
841ac7
+        return EINVAL;
841ac7
+    }
841ac7
 
841ac7
     tmp_ctx = talloc_new(NULL);
841ac7
     if (tmp_ctx == NULL) {
841ac7
@@ -675,6 +715,9 @@ errno_t write_krb5info_file_from_fo_server(struct krb5_service *krb5_service,
841ac7
         return ENOMEM;
841ac7
     }
841ac7
 
841ac7
+    n_lookahead_primary = krb5_service->lookahead_primary;
841ac7
+    n_lookahead_backup = krb5_service->lookahead_backup;
841ac7
+
841ac7
     server_idx = 0;
841ac7
     server_list = talloc_zero_array(tmp_ctx,
841ac7
                                     const char *,
841ac7
@@ -689,6 +732,15 @@ errno_t write_krb5info_file_from_fo_server(struct krb5_service *krb5_service,
841ac7
         address = fo_server_address_or_name(tmp_ctx, server);
841ac7
         if (address) {
841ac7
             server_list[server_idx++] = address;
841ac7
+            if (fo_is_server_primary(server)) {
841ac7
+                if (n_lookahead_primary > 0) {
841ac7
+                    n_lookahead_primary--;
841ac7
+                }
841ac7
+            } else {
841ac7
+                if (n_lookahead_backup > 0) {
841ac7
+                    n_lookahead_backup--;
841ac7
+                }
841ac7
+            }
841ac7
         } else {
841ac7
             DEBUG(SSSDBG_CRIT_FAILURE,
841ac7
                   "Server without name and address found in list.\n");
841ac7
@@ -700,6 +752,8 @@ errno_t write_krb5info_file_from_fo_server(struct krb5_service *krb5_service,
841ac7
              item != server;
841ac7
              item = fo_server_next(item) ? fo_server_next(item) : fo_server_first(item)) {
841ac7
 
841ac7
+            if (primary && n_lookahead_primary == 0) break;
841ac7
+            if (!primary && n_lookahead_backup == 0) break;
841ac7
             if (primary && !fo_is_server_primary(item)) continue;
841ac7
             if (!primary && fo_is_server_primary(item)) continue;
841ac7
             if (filter != NULL && filter(item)) continue;
841ac7
@@ -712,6 +766,11 @@ errno_t write_krb5info_file_from_fo_server(struct krb5_service *krb5_service,
841ac7
             }
841ac7
 
841ac7
             server_list[server_idx++] = address;
841ac7
+            if (primary) {
841ac7
+                n_lookahead_primary--;
841ac7
+            } else {
841ac7
+                n_lookahead_backup--;
841ac7
+            }
841ac7
         }
841ac7
     }
841ac7
     if (server_list[0] == NULL) {
841ac7
@@ -901,7 +960,9 @@ struct krb5_service *krb5_service_new(TALLOC_CTX *mem_ctx,
841ac7
                                       struct be_ctx *be_ctx,
841ac7
                                       const char *service_name,
841ac7
                                       const char *realm,
841ac7
-                                      bool use_kdcinfo)
841ac7
+                                      bool use_kdcinfo,
841ac7
+                                      size_t n_lookahead_primary,
841ac7
+                                      size_t n_lookahead_backup)
841ac7
 {
841ac7
     struct krb5_service *service;
841ac7
 
841ac7
@@ -927,6 +988,9 @@ struct krb5_service *krb5_service_new(TALLOC_CTX *mem_ctx,
841ac7
           realm,
841ac7
           use_kdcinfo ? "true" : "false");
841ac7
     service->write_kdcinfo = use_kdcinfo;
841ac7
+    service->lookahead_primary = n_lookahead_primary;
841ac7
+    service->lookahead_backup = n_lookahead_backup;
841ac7
+
841ac7
     service->be_ctx = be_ctx;
841ac7
     return service;
841ac7
 }
841ac7
@@ -937,6 +1001,8 @@ int krb5_service_init(TALLOC_CTX *memctx, struct be_ctx *ctx,
841ac7
                       const char *backup_servers,
841ac7
                       const char *realm,
841ac7
                       bool use_kdcinfo,
841ac7
+                      size_t n_lookahead_primary,
841ac7
+                      size_t n_lookahead_backup,
841ac7
                       struct krb5_service **_service)
841ac7
 {
841ac7
     TALLOC_CTX *tmp_ctx;
841ac7
@@ -948,7 +1014,8 @@ int krb5_service_init(TALLOC_CTX *memctx, struct be_ctx *ctx,
841ac7
         return ENOMEM;
841ac7
     }
841ac7
 
841ac7
-    service = krb5_service_new(tmp_ctx, ctx, service_name, realm, use_kdcinfo);
841ac7
+    service = krb5_service_new(tmp_ctx, ctx, service_name, realm, use_kdcinfo,
841ac7
+                               n_lookahead_primary, n_lookahead_backup);
841ac7
     if (!service) {
841ac7
         ret = ENOMEM;
841ac7
         goto done;
841ac7
diff --git a/src/providers/krb5/krb5_common.h b/src/providers/krb5/krb5_common.h
841ac7
index be541626b..441c52b34 100644
841ac7
--- a/src/providers/krb5/krb5_common.h
841ac7
+++ b/src/providers/krb5/krb5_common.h
841ac7
@@ -38,6 +38,8 @@
841ac7
 
841ac7
 #define SSS_KRB5KDC_FO_SRV "KERBEROS"
841ac7
 #define SSS_KRB5KPASSWD_FO_SRV "KPASSWD"
841ac7
+#define SSS_KRB5_LOOKAHEAD_PRIMARY_DEFAULT 3
841ac7
+#define SSS_KRB5_LOOKAHEAD_BACKUP_DEFAULT 1
841ac7
 
841ac7
 enum krb5_opts {
841ac7
     KRB5_KDC = 0,
841ac7
@@ -59,6 +61,7 @@ enum krb5_opts {
841ac7
     KRB5_CANONICALIZE,
841ac7
     KRB5_USE_ENTERPRISE_PRINCIPAL,
841ac7
     KRB5_USE_KDCINFO,
841ac7
+    KRB5_KDCINFO_LOOKAHEAD,
841ac7
     KRB5_MAP_USER,
841ac7
 
841ac7
     KRB5_OPTS
841ac7
@@ -71,6 +74,8 @@ struct krb5_service {
841ac7
     char *name;
841ac7
     char *realm;
841ac7
     bool write_kdcinfo;
841ac7
+    size_t lookahead_primary;
841ac7
+    size_t lookahead_backup;
841ac7
     bool removal_callback_available;
841ac7
 };
841ac7
 
841ac7
@@ -160,6 +165,8 @@ errno_t krb5_try_kdcip(struct confdb_ctx *cdb, const char *conf_path,
841ac7
 errno_t sss_krb5_get_options(TALLOC_CTX *memctx, struct confdb_ctx *cdb,
841ac7
                              const char *conf_path, struct dp_option **_opts);
841ac7
 
841ac7
+void sss_krb5_parse_lookahead(const char *param, size_t *primary, size_t *backup);
841ac7
+
841ac7
 errno_t write_krb5info_file(struct krb5_service *krb5_service,
841ac7
                             const char **server_list,
841ac7
                             const char *service);
841ac7
@@ -173,7 +180,9 @@ struct krb5_service *krb5_service_new(TALLOC_CTX *mem_ctx,
841ac7
                                       struct be_ctx *be_ctx,
841ac7
                                       const char *service_name,
841ac7
                                       const char *realm,
841ac7
-                                      bool use_kdcinfo);
841ac7
+                                      bool use_kdcinfo,
841ac7
+                                      size_t n_lookahead_primary,
841ac7
+                                      size_t n_lookahead_backup);
841ac7
 
841ac7
 int krb5_service_init(TALLOC_CTX *memctx, struct be_ctx *ctx,
841ac7
                       const char *service_name,
841ac7
@@ -181,6 +190,8 @@ int krb5_service_init(TALLOC_CTX *memctx, struct be_ctx *ctx,
841ac7
                       const char *backup_servers,
841ac7
                       const char *realm,
841ac7
                       bool use_kdcinfo,
841ac7
+                      size_t n_lookahead_primary,
841ac7
+                      size_t n_lookahead_backup,
841ac7
                       struct krb5_service **_service);
841ac7
 
841ac7
 void remove_krb5_info_files_callback(void *pvt);
841ac7
diff --git a/src/providers/krb5/krb5_init.c b/src/providers/krb5/krb5_init.c
841ac7
index 66ae68fb4..3f4c1b361 100644
841ac7
--- a/src/providers/krb5/krb5_init.c
841ac7
+++ b/src/providers/krb5/krb5_init.c
841ac7
@@ -40,6 +40,8 @@ static errno_t krb5_init_kpasswd(struct krb5_ctx *ctx,
841ac7
     const char *backup_servers;
841ac7
     const char *kdc_servers;
841ac7
     bool use_kdcinfo;
841ac7
+    size_t n_lookahead_primary;
841ac7
+    size_t n_lookahead_backup;
841ac7
     errno_t ret;
841ac7
 
841ac7
     realm = dp_opt_get_string(ctx->opts, KRB5_REALM);
841ac7
@@ -52,6 +54,9 @@ static errno_t krb5_init_kpasswd(struct krb5_ctx *ctx,
841ac7
     primary_servers = dp_opt_get_string(ctx->opts, KRB5_KPASSWD);
841ac7
     backup_servers = dp_opt_get_string(ctx->opts, KRB5_BACKUP_KPASSWD);
841ac7
     use_kdcinfo = dp_opt_get_bool(ctx->opts, KRB5_USE_KDCINFO);
841ac7
+    sss_krb5_parse_lookahead(dp_opt_get_string(ctx->opts, KRB5_KDCINFO_LOOKAHEAD),
841ac7
+                             &n_lookahead_primary, &n_lookahead_backup);
841ac7
+
841ac7
 
841ac7
     if (primary_servers == NULL && backup_servers != NULL) {
841ac7
         DEBUG(SSSDBG_CONF_SETTINGS, "kpasswd server wasn't specified but "
841ac7
@@ -67,7 +72,10 @@ static errno_t krb5_init_kpasswd(struct krb5_ctx *ctx,
841ac7
     } else {
841ac7
         ret = krb5_service_init(ctx, be_ctx, SSS_KRB5KPASSWD_FO_SRV,
841ac7
                                 primary_servers, backup_servers, realm,
841ac7
-                                use_kdcinfo, &ctx->kpasswd_service);
841ac7
+                                use_kdcinfo,
841ac7
+                                n_lookahead_primary,
841ac7
+                                n_lookahead_backup,
841ac7
+                                &ctx->kpasswd_service);
841ac7
         if (ret != EOK) {
841ac7
             DEBUG(SSSDBG_FATAL_FAILURE,
841ac7
                   "Failed to init KRB5KPASSWD failover service!\n");
841ac7
@@ -84,6 +92,8 @@ static errno_t krb5_init_kdc(struct krb5_ctx *ctx, struct be_ctx *be_ctx)
841ac7
     const char *backup_servers;
841ac7
     const char *realm;
841ac7
     bool use_kdcinfo;
841ac7
+    size_t n_lookahead_primary;
841ac7
+    size_t n_lookahead_backup;
841ac7
     errno_t ret;
841ac7
 
841ac7
     realm = dp_opt_get_string(ctx->opts, KRB5_REALM);
841ac7
@@ -96,10 +106,15 @@ static errno_t krb5_init_kdc(struct krb5_ctx *ctx, struct be_ctx *be_ctx)
841ac7
     backup_servers = dp_opt_get_string(ctx->opts, KRB5_BACKUP_KDC);
841ac7
 
841ac7
     use_kdcinfo = dp_opt_get_bool(ctx->opts, KRB5_USE_KDCINFO);
841ac7
+    sss_krb5_parse_lookahead(dp_opt_get_string(ctx->opts, KRB5_KDCINFO_LOOKAHEAD),
841ac7
+                             &n_lookahead_primary, &n_lookahead_backup);
841ac7
 
841ac7
     ret = krb5_service_init(ctx, be_ctx, SSS_KRB5KDC_FO_SRV,
841ac7
                             primary_servers, backup_servers, realm,
841ac7
-                            use_kdcinfo, &ctx->service);
841ac7
+                            use_kdcinfo,
841ac7
+                            n_lookahead_primary,
841ac7
+                            n_lookahead_backup,
841ac7
+                            &ctx->service);
841ac7
     if (ret != EOK) {
841ac7
         DEBUG(SSSDBG_FATAL_FAILURE, "Failed to init KRB5 failover service!\n");
841ac7
         return ret;
841ac7
diff --git a/src/providers/krb5/krb5_opts.c b/src/providers/krb5/krb5_opts.c
841ac7
index 6bec52767..05395e0f4 100644
841ac7
--- a/src/providers/krb5/krb5_opts.c
841ac7
+++ b/src/providers/krb5/krb5_opts.c
841ac7
@@ -42,6 +42,7 @@ struct dp_option default_krb5_opts[] = {
841ac7
     { "krb5_canonicalize", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
841ac7
     { "krb5_use_enterprise_principal", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
841ac7
     { "krb5_use_kdcinfo", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
841ac7
+    { "krb5_kdcinfo_lookahead", DP_OPT_STRING, NULL_STRING, NULL_STRING },
841ac7
     { "krb5_map_user", DP_OPT_STRING, NULL_STRING, NULL_STRING },
841ac7
     DP_OPTION_TERMINATOR
841ac7
 };
841ac7
diff --git a/src/providers/ldap/ldap_common.c b/src/providers/ldap/ldap_common.c
841ac7
index 9cd8ec09c..4c49f08c5 100644
841ac7
--- a/src/providers/ldap/ldap_common.c
841ac7
+++ b/src/providers/ldap/ldap_common.c
841ac7
@@ -335,6 +335,8 @@ int sdap_gssapi_init(TALLOC_CTX *mem_ctx,
841ac7
     const char *krb5_opt_realm;
841ac7
     struct krb5_service *service = NULL;
841ac7
     TALLOC_CTX *tmp_ctx;
841ac7
+    size_t n_lookahead_primary;
841ac7
+    size_t n_lookahead_backup;
841ac7
 
841ac7
     tmp_ctx = talloc_new(NULL);
841ac7
     if (tmp_ctx == NULL) return ENOMEM;
841ac7
@@ -361,11 +363,18 @@ int sdap_gssapi_init(TALLOC_CTX *mem_ctx,
841ac7
         }
841ac7
     }
841ac7
 
841ac7
+    sss_krb5_parse_lookahead(
841ac7
+        dp_opt_get_string(opts, SDAP_KRB5_KDCINFO_LOOKAHEAD),
841ac7
+        &n_lookahead_primary,
841ac7
+        &n_lookahead_backup);
841ac7
+
841ac7
     ret = krb5_service_init(mem_ctx, bectx,
841ac7
                             SSS_KRB5KDC_FO_SRV, krb5_servers,
841ac7
                             krb5_backup_servers, krb5_realm,
841ac7
                             dp_opt_get_bool(opts,
841ac7
                                             SDAP_KRB5_USE_KDCINFO),
841ac7
+                            n_lookahead_primary,
841ac7
+                            n_lookahead_backup,
841ac7
                             &service);
841ac7
     if (ret != EOK) {
841ac7
         DEBUG(SSSDBG_FATAL_FAILURE, "Failed to init KRB5 failover service!\n");
841ac7
diff --git a/src/providers/ldap/ldap_opts.c b/src/providers/ldap/ldap_opts.c
841ac7
index f7574fac2..613fe7463 100644
841ac7
--- a/src/providers/ldap/ldap_opts.c
841ac7
+++ b/src/providers/ldap/ldap_opts.c
841ac7
@@ -82,6 +82,7 @@ struct dp_option default_basic_opts[] = {
841ac7
     { "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING },
841ac7
     { "krb5_canonicalize", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
841ac7
     { "krb5_use_kdcinfo", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
841ac7
+    { "krb5_kdcinfo_lookahead", DP_OPT_STRING, NULL_STRING, NULL_STRING },
841ac7
     { "ldap_pwd_policy", DP_OPT_STRING, { "none" }, NULL_STRING },
841ac7
     { "ldap_referrals", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
841ac7
     { "account_cache_expiration", DP_OPT_NUMBER, { .number = 0 }, NULL_NUMBER },
841ac7
diff --git a/src/providers/ldap/sdap.h b/src/providers/ldap/sdap.h
841ac7
index 0f79ae9de..48061d389 100644
841ac7
--- a/src/providers/ldap/sdap.h
841ac7
+++ b/src/providers/ldap/sdap.h
841ac7
@@ -199,6 +199,7 @@ enum sdap_basic_opt {
841ac7
     SDAP_KRB5_REALM,
841ac7
     SDAP_KRB5_CANONICALIZE,
841ac7
     SDAP_KRB5_USE_KDCINFO,
841ac7
+    SDAP_KRB5_KDCINFO_LOOKAHEAD,
841ac7
     SDAP_PWD_POLICY,
841ac7
     SDAP_REFERRALS,
841ac7
     SDAP_ACCOUNT_CACHE_EXPIRATION,
841ac7
-- 
841ac7
2.19.1
841ac7