On 04/15/2010 07:10 AM, Sumit Bose wrote:
Hi,
these two patches provides a new attempt for the IPA password migration
feature. The first one wraps the Kerberos authentication in the Kerberos
provider into a tevent request to make it easy accessible for IPA
authentication. The LDAP provider already has all needed features as
tevent requests.
The second patch changes IPA auth to use only tevent request from the
LDAP and Kerberos provider. The ipaMigrationEnabled flag is read from
the server, too.
Both patches only apply to sssd-1-2. Because of the sync sysdb patches
in master it is not easy to merge the first patch. I will rewrite the
first patch and provider the patches for master if we agree that the way
the two patches here handle password migration is the way we want to go.
bye,
Sumit
Patch 0001: Nack.
There are several places in krb5_auth_send() that return
tevent_req_error() that should not (e.g. we're offline and trying to do
a chpass or we don't handle a particular PAM command). We should reserve
tevent_req_error for internal errors like ENOMEM or broken configuration.
In krb5_find_ccache_step:
if (kr->ccname == NULL ||
(be_is_offline(state->be_ctx) && !kr->active_ccache_present
&&
!kr->valid_tgt_present) ||
(!be_is_offline(state->be_ctx) && !kr->active_ccache_present))
Should be:
if((kr->ccname == NULL || !kr->active_ccache_present ||
(be_is_offline(be_req->be_ctx) && !kr->valid_tgt_present))
Patch 0002 review forthcoming.
--
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/