On (02/03/16 10:02), Simo Sorce wrote:
>On Wed, 2016-03-02 at 15:34 +0100, Lukas Slebodnik wrote:
>> On (01/03/16 18:28), Simo Sorce wrote:
>> >On Tue, 2016-03-01 at 18:22 -0500, Simo Sorce wrote:
>> >> On Tue, 2016-03-01 at 22:34 +0100, Lukas Slebodnik wrote:
>> >> > On (01/03/16 12:05), Simo Sorce wrote:
>> >> > >On Tue, 2016-03-01 at 17:51 +0100, Lukas Slebodnik wrote:
>> >> > >> On (01/03/16 17:45), Lukas Slebodnik wrote:
>> >> > >> >On (31/01/16 11:53), Simo Sorce wrote:
>> >> > >> >>Expired != Disabled
>> >> > >> >>this change is intentional.
>> >> > >> >>
>> >> > >> >Yes, but explain it to Active directory :-)
>> >> > >> >
>> >> > >> >Attached is patch with workaround/hack
>> >> > >> >regression with expired AD users.
>> >> > >> >
>> >> > >> ENOPATCH
>> >> > >>
>> >> > >> LS
>> >> > >
>> >> > >I think a better approach is to return the KRBKDC error from
the child
>> >> > >without mapping (or with an intermediate mapping) and have the
IPA and
>> >> > >AD providers map it on their own.
>> >> > >
>> >> > It's not related to mapping KRBKDC error codes to internal
error code.
>> >> > The main problem is that AD return the same error code for
expired
>> >> > and disabled user. And ad provider used generic krb5 functions.
>> >> >
>> >> > BTW the same issue would be with id_provider ldap +
>> >> > auth_provider = krb5 with AD :-(
>> >> > I'm not sure how your proposal would help.
>> >>
>> >> I think AD returns additional information in edata, maybe we can use
>> >> that to do the proper mapping in the generic krb5 code.
>> >>
>> >> Absence of AD specific edata would indicate MIT mapping, presence
would
>> >> allow us to use that additional data to figure out the correct
mapping.
>> >>
>> >> Simo.
>> >>
>> >
>> >See MS-KILE[1] 2.2.1, I bet the two conditions returns two different
>> >windows Style errors in etext (not edata, sorry).
>> >
>> >[1]
https://msdn.microsoft.com/en-us/library/cc233855.aspx
>> >
>> Interesting idea and it seems to work.
>> The main difference was in time and last octet string.
>> * response for expired user [2]
>> the last octet string in ASN:
>> 930100C00000000001000000
>
>This is error C0000193 aka NT_STATUS_ACCOUNT_EXPIRED NT_STATUS
>https://git.samba.org/?p=samba.git;a=blob;f=libcli/util/ntstatus.h;h=572093b431d80c9e12461255d01063412bbfa5b5;hb=HEAD#l494
>
>> * response for disabled user [3]
>> the last octet string in ASN:
>> 720000C00000000001000000T
>
>This is error C0000072, aka NT_STATUS_ACCOUNT_DISABLED NT_STATUS
>https://git.samba.org/?p=samba.git;a=blob;f=libcli/util/ntstatus.h;h=572093b431d80c9e12461255d01063412bbfa5b5;hb=HEAD#l211
>>
>> The only question is how to get etext from krb5 response.
>> I do not want to implement ASN.1 parser.
>
>We use asn1c in FreeIPA if we need to generate a parser, but I do not
>think we need to get that far.
>The main issue is whether the krb5 fucntions let us get access to the
>etext data at all, it seem buried pretty low in the internal of krb5.
>
It took me a while to find out why my patch broke password change
then I realized I have unused argument in_tkt_service
in my version of krb5_get_init_creds_password.
We might enable gcc warning Wunused-argument :-)
Please review attached patch.
There is a difference between using krb5_get_init_creds_password() and
the function you created in that the krb5 native API actually retries by
locating a KDC master server if the initial attempt fails and the KDC
that was contacted is not a master KDC.
Is that functionality we want to preserve ?
Otherwise LGTM.
Simo.
--
Simo Sorce * Red Hat, Inc * New York