-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 08/28/2014 10:00 PM, John Koelndorfer wrote:
Hey folks,
Some quick background on this small patch I prepared. I run sssd on
my desktop (and servers) to authenticate against a Samba 4 DC. I
found that when I attempted to log in via KDM and misentered my
password, I got an error about the authentication system failing.
Similarly, `su` would return an error message I was not familar
with: "Failure setting user credentials".
After some inspection of the sssd sources, I found that per
http://pubs.opengroup.org/onlinepubs/8329799/pam_sm_authenticate.htm,
sssd's PAM module is returning the wrong error code when a user
entered bad credentials. PAM_CRED_ERR is being returned instead of
PAM_AUTH_ERR.
Applying the attached patch and recompliing sssd brought back the
more familiar "Authentication failure" when su'ing with a bad
password. KDM also doesn't freak out when I enter an incorrect
password.
If you have any questions about the patch, please be sure to
include me in the reply as I'm not on the sssd-devel list.
Thanks for sssd, it has been awesome!
Thanks for the patch! Unfortunately, it's a little bit overzealous.
There are several cases in here for which PAM_CRED_ERR is actually
correct.
For example, in krb5_auth.c, we return PAM_AUTH_ERR if the kerberos
request returns ERR_AUTH_FAILED, but we return PAM_CRED_ERR
specifically on kerberos returning ERR_CRED_ERR.
PAM_AUTH_ERR is intended to be returned when the server was
succesfully able to perform the authentication and explicitly
determined that the user was denied. PAM_CRED_ERR should indicate that
the password failed to validate for some other reason. According to
krb5_child.c, that can happen as a result of three return codes:
KRB5_PROG_ETYPE_NOSUPP (The client and the server don't have any
matching encryption keys)
KRB5_PREAUTH_FAILED (A one-time passwords or pkinit event failed)
KRB5KDC_ERR_PREAUTH_FAILED (The same as above, or a failure while
setting up a FAST tunnel occurred).
Are you using FAST on your setup? (The option krb5_use_fast = True)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAlQHq1QACgkQeiVVYja6o6PdiQCeOkmHb/nfSg3UwZFnNtsxlhz1
U84An3C6kPthahgNc26m5RhwCJpmzY7q
=URR1
-----END PGP SIGNATURE-----