From ed9e516b0a9efd504dfad06d5f6ca0d56b7cdd09 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Wed, 4 Jan 2012 10:11:37 -0500 Subject: [PATCH] Do not call krb5_child when changing passwords and provider went offline https://fedorahosted.org/sssd/ticket/1131 --- src/providers/krb5/krb5_auth.c | 12 +++++++++++- 1 files changed, 11 insertions(+), 1 deletions(-) diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c index 66cee473c73ca19cce5f58e13026b192267c1531..14a7c547f0db8892834e5d3b5ca1380a1b1c163d 100644 --- a/src/providers/krb5/krb5_auth.c +++ b/src/providers/krb5/krb5_auth.c @@ -542,9 +542,19 @@ static void krb5_resolve_kdc_done(struct tevent_req *subreq) /* all servers have been tried and none * was found good, setting offline, * but we still have to call the child to setup - * the ccache file. */ + * the ccache file if we are performing auth */ be_mark_offline(state->be_ctx); kr->is_offline = true; + + if (kr->pd->cmd == SSS_PAM_CHAUTHTOK || + kr->pd->cmd == SSS_PAM_CHAUTHTOK_PRELIM) { + DEBUG(SSSDBG_TRACE_FUNC, + ("No KDC suitable for password change is available\n")); + state->pam_status = PAM_AUTHTOK_LOCK_BUSY; + state->dp_err = DP_ERR_OK; + tevent_req_done(req); + return; + } } else { if (kr->krb5_ctx->kpasswd_service != NULL) { subreq = be_resolve_server_send(state, state->ev, state->be_ctx, -- 1.7.7.4