subversion-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Tim-Christian Bloss (JIRA)" <>
Subject [jira] [Commented] (SVN-4641) silent incomplete checkout with Kerberos timeout
Date Sun, 18 Sep 2016 19:06:22 GMT


Tim-Christian Bloss commented on SVN-4641:


we've found out we're running into two alternating issues:

- When checking out 5 minutes before kerberos tickets come to end of life, checkout goes 5
minutes and on end of kerberos ticket validity checkout terminates without error code

- When checking out large svn structures which takes longer than apache timeout (due to massive
network load), checkout terminates without error code when using kerberos.

The ticket indeed lasts 8-10 hours, but we've often managed in our automatic builds to checkout
about 5 minutes before expiry and renewing happend to a "bad time" , and that reoccuring,
so we see indeed checkouts terminate due to ticket expiry without getting error codes.

The checkout duration is not an issue at our sites when using simple/basic authentication
instead of kerberos, neither regarding kerberos tickets, nor regarding apache server timeout.

Best regards

> silent incomplete checkout with Kerberos timeout
> ------------------------------------------------
>                 Key: SVN-4641
>                 URL:
>             Project: Subversion
>          Issue Type: Bug
>          Components: cmdline client
>    Affects Versions: 1.8.8, 1.9.4
>         Environment: Server is Debian GNU/Linux 8, Apache 2.4, using either old SVN 1.8.10
and also when cleanly upgraded to 1.9.4 (using completely newly created svn repo), supporting
Kerberos authentication, x86_64.
> Client is Windows 2008 R2 x86_64, svn cli 1.9.4, using Kerberos authentication.
> Kerberos Tickets are valid for 5 minutes.
> Checkout takes much longer than 5 minutes.
>            Reporter: Tim-Christian Bloss
>            Priority: Critical
>              Labels: performance, security, windows
> When checking out by svn CLI using Kerberos tickes for authentication and checkout takes
more than 5 minutes (time that Kerberos tickets are valid), then the checkout ends with state
"success" (return code 0) but all files which could not be fetched within the validity duration
of the Kerberos ticket are missing.
> SVN also does not seem to print any warnings or information regarding this issue we could
automatically react on.
> This leads to supposedly successfull checkouts but builds do fail due to missing resources.
> Example: Large maven project structure of 200+ submodules (yes we know it's "not nice",
but there's no chance to change this!), checkout takes about 15 minutes, but after 5 minutes
checkout end with state "success", but two thirds of data volume do not get checked out, including
the main pom.xml.
> The same checkout using Debign GNU/Linux 8 x86_64 with cli 1.9.4 and basic authentication
works correct, checking all files out, taking the full expected 15 minutes for the checkout.

This message was sent by Atlassian JIRA

View raw message