From dea83a7802b92da09a666cee9d820e42d24dc388 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Mon, 4 Jul 2016 15:52:00 +0200 Subject: [PATCH 2/4] localauth: make plugin non-authoritative on failures According to the documentation in localauth_plugin.h "aname will be considered authorized if at least one module returns 0 and all other modules return KRB5_PLUGIN_NO_HANDLE." So it is safe to always return KRB5_PLUGIN_NO_HANDLE because a different plugin has to return 0 to allow access to the given principal. Resolves https://fedorahosted.org/sssd/ticket/2788 --- src/krb5_plugin/sssd_krb5_localauth_plugin.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/krb5_plugin/sssd_krb5_localauth_plugin.c b/src/krb5_plugin/sssd_krb5_localauth_plugin.c index 1e77d5227b6766303849505d887182f2a387a43b..13ab07d1315430f11f7bbc916f25d2c837bec78c 100644 --- a/src/krb5_plugin/sssd_krb5_localauth_plugin.c +++ b/src/krb5_plugin/sssd_krb5_localauth_plugin.c @@ -49,7 +49,8 @@ static krb5_error_code sss_userok(krb5_context context, kerr = krb5_unparse_name(context, aname, &princ_str); if (kerr != 0) { - return kerr; + ret = kerr; + goto done; } if (strcasecmp(princ_str, lname) == 0) { @@ -98,6 +99,10 @@ done: krb5_free_unparsed_name(context, princ_str); free(buffer); + if (ret != 0) { + return KRB5_PLUGIN_NO_HANDLE; + } + return ret; } -- 2.1.0