Re: OpenAFS 1.8.X token problems

Florian,

Please see my comments and questions interleaved below:

> On May 22, 2019, at 5:34 AM, Florian Möller <[email protected]> wrote:
> 
> we are experiencing problems with the 1.8.X client.
> 
> The servers of our cell run OpenAFS 1.8.3. Everything works fine using the 1.6.X client. When using 1.8.X the following strange behaviour occurs:
> 
> aklog seems to obtain a token; "aklog -d username" gives
> 
> Authenticating to cell ifm (server [correct name]).
> Trying to authenticate to user's realm IFM.
> Getting tickets: afs/ifm@IFM
> Using Kerberos V5 ticket natively
> About to resolve name username to id in cell ifm.
> Id [correct id]
> Setting tokens. username @ ifm
> 
> But the token is not stored properly. "tokens" gives
> 
> Tokens held by the Cache Manager:
> 
> tokens: failed to get token info for cell ifm (code 11862788)
>   --End of list--

We can use a little-known OpenAFS utility to help with this: 
$ translate_et 11862788
11862788 (ktc).4 = a pioctl failed

This is KTC_PIOCTLFAIL.  But which pioctl failed, and why?

Your strace was very helpul in that respect:
> 
> Here are the relevant portions of "strace tokens":
> 
> openat(AT_FDCWD, "/proc/fs/openafs/afs_ioctl", O_RDONLY) = 3
> ioctl(3, _IOC(_IOC_WRITE, 0x43, 0x1, 0x8), 0x7ffc3529aae0) = -1 EDOM (Numerical argument out of domain)

Pioctl 0x8 is VIOCGETTOK (get token); it is usually called repeatedly to obtain one token at a time, and returns EDOM to indicate there are no more tokens for the requested user.  So this EDOM is not necessarily a problem.

However, the fact that you are running 1.8.x but calling VIOCGETTOK may be a clue.  VIOCGETTOK is a "legacy" 1.6.x token interface; 1.8.x clients (e.g. aklog, tokens) will call the 1.8.x token interface VIOC_GETTOK2 first, and fall back to VIOCGETTOK if there is a problem.  So your strace tells me there was some kind of problem that caused a fallback.

Before we go any further with that, I would like you to verify that all the OpenAFS components are the same version.  Please provide the output from the following commands:
- rxdebug <client> 7001 -version
- strings $(which aklog) | grep OpenAFS
- strings $(which tokens) | grep OpenAFS

Thanks,
--
Mark Vitale
[email protected]