On 09/03/2014 07:59 PM, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 08/28/2014 10:00 PM, John Koelndorfer wrote:
> Hey folks,
>
> Some quick background on this small patch I prepared. I run sssd on
> my desktop (and servers) to authenticate against a Samba 4 DC. I
> found that when I attempted to log in via KDM and misentered my
> password, I got an error about the authentication system failing.
> Similarly, `su` would return an error message I was not familar
> with: "Failure setting user credentials".
>
> After some inspection of the sssd sources, I found that per
>
http://pubs.opengroup.org/onlinepubs/8329799/pam_sm_authenticate.htm,
>
>
sssd's PAM module is returning the wrong error code when a user
> entered bad credentials. PAM_CRED_ERR is being returned instead of
> PAM_AUTH_ERR.
>
> Applying the attached patch and recompliing sssd brought back the
> more familiar "Authentication failure" when su'ing with a bad
> password. KDM also doesn't freak out when I enter an incorrect
> password.
>
> If you have any questions about the patch, please be sure to
> include me in the reply as I'm not on the sssd-devel list.
>
> Thanks for sssd, it has been awesome!
>
Thanks for the patch! Unfortunately, it's a little bit overzealous.
There are several cases in here for which PAM_CRED_ERR is actually
correct.
For example, in krb5_auth.c, we return PAM_AUTH_ERR if the kerberos
request returns ERR_AUTH_FAILED, but we return PAM_CRED_ERR
specifically on kerberos returning ERR_CRED_ERR.
PAM_AUTH_ERR is intended to be returned when the server was
succesfully able to perform the authentication and explicitly
determined that the user was denied. PAM_CRED_ERR should indicate that
the password failed to validate for some other reason. According to
krb5_child.c, that can happen as a result of three return codes:
KRB5_PROG_ETYPE_NOSUPP (The client and the server don't have any
matching encryption keys)
KRB5_PREAUTH_FAILED (A one-time passwords or pkinit event failed)
KRB5KDC_ERR_PREAUTH_FAILED (The same as above, or a failure while
setting up a FAST tunnel occurred).
Are you using FAST on your setup? (The option krb5_use_fast = True)
John and I debugged this some today on #sssd. It turns out that the Samba 4 DC (and we
suspect the Active Directory DC) returns the KRB5KDC_ERR_PREAUTH_FAILED on an incorrect
password, and not KRB5KRB_AP_ERR_BAD_INTEGRITY like the MIT KDC does.
Unfortunately, we have code in krb5_auth.c that is using KRB5KDC_ERR_PREAUTH_FAILED as one
possible way of detecting that SSSD is in migration mode from FreeIPA, so this is going to
require a little bit of careful design to solve properly.
I've been too far removed from the Kerberos code for too long, so I'd very much
appreciate it if one of our resident Kerberos experts could take a closer look at this
one.