Hi,
the two attached patches fix
https://fedorahosted.org/sssd/ticket/2861
The first removes dp_pam_err_to_string() completely. It was wrong to use
function that calls pam_strerror() for non-PAM callbacks and even worse
that the PAM callback itself didn't call dp_pam_err_to_string..
The second guards against similar mistakes in the future by checking for
valid UTF-8 string. I think we should do this because technically there
can be a 3rd party provider.
I also have another patch that reduced code duplication -- because I
suspect that copy-pasting was the original reason this bug was
introduced. But I need to test the patches more, because they touch all
callbacks..