On Wed, 2016-03-02 at 15:34 +0100, Lukas Slebodnik wrote:
On (01/03/16 18:28), Simo Sorce wrote:
>On Tue, 2016-03-01 at 18:22 -0500, Simo Sorce wrote:
>> On Tue, 2016-03-01 at 22:34 +0100, Lukas Slebodnik wrote:
>> > On (01/03/16 12:05), Simo Sorce wrote:
>> > >On Tue, 2016-03-01 at 17:51 +0100, Lukas Slebodnik wrote:
>> > >> On (01/03/16 17:45), Lukas Slebodnik wrote:
>> > >> >On (31/01/16 11:53), Simo Sorce wrote:
>> > >> >>Expired != Disabled
>> > >> >>this change is intentional.
>> > >> >>
>> > >> >Yes, but explain it to Active directory :-)
>> > >> >
>> > >> >Attached is patch with workaround/hack
>> > >> >regression with expired AD users.
>> > >> >
>> > >> ENOPATCH
>> > >>
>> > >> LS
>> > >
>> > >I think a better approach is to return the KRBKDC error from the child
>> > >without mapping (or with an intermediate mapping) and have the IPA and
>> > >AD providers map it on their own.
>> > >
>> > It's not related to mapping KRBKDC error codes to internal error code.
>> > The main problem is that AD return the same error code for expired
>> > and disabled user. And ad provider used generic krb5 functions.
>> >
>> > BTW the same issue would be with id_provider ldap +
>> > auth_provider = krb5 with AD :-(
>> > I'm not sure how your proposal would help.
>>
>> I think AD returns additional information in edata, maybe we can use
>> that to do the proper mapping in the generic krb5 code.
>>
>> Absence of AD specific edata would indicate MIT mapping, presence would
>> allow us to use that additional data to figure out the correct mapping.
>>
>> Simo.
>>
>
>See MS-KILE[1] 2.2.1, I bet the two conditions returns two different
>windows Style errors in etext (not edata, sorry).
>
>[1]
https://msdn.microsoft.com/en-us/library/cc233855.aspx
>
Interesting idea and it seems to work.
The main difference was in time and last octet string.
* response for expired user [2]
the last octet string in ASN:
930100C00000000001000000
This is error C0000193 aka NT_STATUS_ACCOUNT_EXPIRED NT_STATUS
https://git.samba.org/?p=samba.git;a=blob;f=libcli/util/ntstatus.h;h=5720...
* response for disabled user [3]
the last octet string in ASN:
720000C00000000001000000T
This is error C0000072, aka NT_STATUS_ACCOUNT_DISABLED NT_STATUS
https://git.samba.org/?p=samba.git;a=blob;f=libcli/util/ntstatus.h;h=5720...
The only question is how to get etext from krb5 response.
I do not want to implement ASN.1 parser.
We use asn1c in FreeIPA if we need to generate a parser, but I do not
think we need to get that far.
The main issue is whether the krb5 fucntions let us get access to the
etext data at all, it seem buried pretty low in the internal of krb5.
Simo.
--
Simo Sorce * Red Hat, Inc * New York