[SSSD] [PATCH] Convert ldap_auth to new error codes

Jakub Hrozek jhrozek at redhat.com
Tue Mar 5 17:46:00 UTC 2013


On Tue, Mar 05, 2013 at 05:11:29PM +0100, Pavel Březina wrote:
> On 03/04/2013 07:34 PM, Simo Sorce wrote:
> >On Mon, 2013-03-04 at 13:29 -0500, Simo Sorce wrote:
> >>On Mon, 2013-03-04 at 13:10 +0100, Pavel Březina wrote:
> >>>On 02/28/2013 12:29 AM, Simo Sorce wrote:
> >>>>This patch removes yet another set of custom and parallel error codes
> >>>>specified in the sdap_result enumeration, and instead uses the new
> >>>>unified error codes.
> >>>>
> >>>>This is to be applied on top of the previous patchset that adds SSSD
> >>>>specific error codes.
> >>>>
> >>>>I have done minimal testing with my IPA install and it seems to work
> >>>>fine as far as ldap+SASL/GSSAPI auth goes.
> >>>>
> >>>>Simo.
> >>>>
> >>>
> >>>Hi,
> >>>
> >>>>@@ -771,14 +776,19 @@ static struct tevent_req *sasl_bind_send(TALLOC_CTX *memctx,
> >>>>           if (ret) goto fail;
> >>>>       }
> >>>>
> >>>>+    /* This is a hack, relies on the fact that tevent_req_done() will only set
> >>>>+     * the state if no callback has been set yet
> >>>
> >>>This is not true. tevent_req_done() always sets the state, even if
> >>>there is no callback yet.
> >>
> >>I think my wording was misleading.
> >>
> >>What I meant here is that tevent_req_done *only* sets they state, and if
> >>no callback is set nothing bad will happen. I will reword it so that it
> >>more clear.
> >>
> >>>and then the immediate event
> >>>>+     * set up by tevent_req_post() will call the async callback set by the
> >>>>+     * caller right after we return */
> >>>>+    tevent_req_done(req);
> >>>>       tevent_req_post(req, ev);
> >>>>       return req;
> >>>>
> >>>>   fail:
> >>>>-    if (ret == LDAP_SERVER_DOWN) {
> >>>>+    if (ret == LDAP_SERVER_DOWN || ret == LDAP_TIMEOUT) {
> >>>>           tevent_req_error(req, ETIMEDOUT);
> >>>>       } else {
> >>>>-        tevent_req_error(req, EIO);
> >>>>+        tevent_req_error(req, ERR_AUTH_FAILED);
> >>>>       }
> >>>>       tevent_req_post(req, ev);
> >>>>       return req;
> >>>
> >>>Otherwise it seems to be working correctly. I correct password,
> >>>incorrect password, changing password, password expiration,
> >>>enable/disable user with both LDAP (without kerberos) and IPA.
> >>
> >>Excellent, thanks!
> >
> >Patch with reworded comment attached.
> >
> >Simo.
> 
> This is much better. Ack.

It seems that at least some error codes are mishandled. When I attempt
to auth with a bad password, SSSD returns System Error. This is not what
we want, for some display managers (xdm and I thin even kdm) the System
Error retval would mean a popup is displayed to the user.

Auth, GSSAPI auth and offline auth works fine, though.



More information about the sssd-devel mailing list