>From 43168b54be69ac4a7ecbf45647d00c9c83ee983a Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Wed, 4 Jan 2012 10:11:37 -0500 Subject: [PATCH 2/2] Do not call krb5_child when changing passwords and provider went offline https://fedorahosted.org/sssd/ticket/1131 --- src/providers/krb5/krb5_auth.c | 11 ++++++++++- 1 files changed, 10 insertions(+), 1 deletions(-) diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c index 66cee473c73ca19cce5f58e13026b192267c1531..0290383943bc4cde6d80ba137dc6f7d548f7efca 100644 --- a/src/providers/krb5/krb5_auth.c +++ b/src/providers/krb5/krb5_auth.c @@ -542,9 +542,18 @@ static void krb5_resolve_kdc_done(struct tevent_req *subreq) /* all servers have been tried and none * was found good, setting offline, * but we still have to call the child to setup - * the ccache file. */ + * the ccache file if we are performing auth */ be_mark_offline(state->be_ctx); kr->is_offline = true; + + if (kr->pd->cmd == SSS_PAM_CHAUTHTOK || + kr->pd->cmd == SSS_PAM_CHAUTHTOK_PRELIM) { + DEBUG(5, ("No KDC suitable for password change is available\n")); + state->pam_status = PAM_AUTHTOK_LOCK_BUSY; + state->dp_err = DP_ERR_OK; + tevent_req_done(req); + return; + } } else { if (kr->krb5_ctx->kpasswd_service != NULL) { subreq = be_resolve_server_send(state, state->ev, state->be_ctx, -- 1.7.7.4