URL:
https://github.com/SSSD/sssd/pull/5847
Author: stanislavlevin
Title: #5847: pam_sss: Allow offline authentication against non-ipa-desktopprofiles aware
DC
Action: opened
PR body:
"""
IPA domain controller may not support desktop profiles since this
functionality is optional and distributed as the IPA plugin:
- in case of online authentication ipa_session detects such DC properly
and returns PAM_SUCCESS for ENOENT, nothing is cached on sysdb (see
ipa_deskprofile_get_config_send/ipa_deskprofile_get_config_done and
ipa_pam_session_handler_done for details).
- in case of offline authentication ipa_session falls back to cache and
receives ENOENT (since nothing was cached previously). But *any* error
is treated as actual error and overall result is PAM_SESSION_ERR (see
ipa_pam_session_handler_save_deskprofile_rules and
ipa_pam_session_handler_done for details). Note: actually, only
deskprofile_get_cached_priority breaks PAM session since
ipa_common_get_cached_rules successfully handles ENOENT.
- in either case sssd tries to send dbus notification to fleet
commander even if there are no desktop profile rules to apply.
With this change ENOENT result of cache query is treated similarly
to ENOENT result of actual backend query (PAM_SUCCESS).
Resolves:
https://github.com/SSSD/sssd/issues/5846
"""
To pull the PR as Git branch:
git remote add ghsssd
https://github.com/SSSD/sssd
git fetch ghsssd pull/5847/head:pr5847
git checkout pr5847