On Fri, May 24, 2013 at 04:52:49PM +0200, Lukas Slebodnik wrote:
ehlo,
Commit c6872e79e8496fd075e20aec0343ade99cca725c caused that password migration
doesn't work using sssd.
If pre authentication failed then we should send message to backend,
so password migration could be detected.
https://fedorahosted.org/sssd/ticket/1873
Patch is attached.
LS
Hi,
sorry the review took such a long time. However, this is not the correct
approach. If you take a look at ipa_auth.c and how the migration is
performed in src/providers/ipa/ipa_auth.c:
263 if (state->pd->cmd == SSS_PAM_AUTHENTICATE &&
264 state->pd->pam_status == PAM_CRED_ERR) {
265
266 req = get_password_migration_flag_send(state, state->ev,
The migration is attempted if the krb5_auth request returns PAM_CRED_ERR
as the PAM error. Now the PAM error is converted from an error code the
Kerberos child process sends to the krb5_auth request in
krb5_auth_done().
When a user is migrated from LDAP then the authentication would fail
with KRB5_PREAUTH_FAILED in the krb5_child process and the krb5_child
would return ERR_AUTH_FAILED (see src/providers/krb5/krb5_child.c:1201).
ERR_AUTH_FAILED is then converted in krb5_auth_done() into PAM_AUTH_ERR.
So I see two options here:
1) change the condition in ipa_auth.c from detecting PAM_CRED_ERR to
detecting PAM_AUTH_ERR. I don't like this because any authentication
failure would then check the migration flag.
2) Add a new ERR_AUTH code, maybe ERR_PREAUTH_FAILED to krb5_child,
return that instead of ERR_AUTH_FAILED from the krb5_child and
convert ERR_PREAUTH_FAILED into PAM_CRED_ERR in krb5_auth_done.
BTW to prove this was indeed the root cause, I tested by implementing 1)
option above:
diff --git a/src/providers/ipa/ipa_auth.c b/src/providers/ipa/ipa_auth.c
index 651196a..03576eb 100644
--- a/src/providers/ipa/ipa_auth.c
+++ b/src/providers/ipa/ipa_auth.c
@@ -261,7 +261,7 @@ static void ipa_auth_handler_done(struct tevent_req *req)
}
if (state->pd->cmd == SSS_PAM_AUTHENTICATE &&
- state->pd->pam_status == PAM_CRED_ERR) {
+ state->pd->pam_status == PAM_AUTH_ERR) {
req = get_password_migration_flag_send(state, state->ev,
state->ipa_auth_ctx->sdap_id_ctx,
And the migration worked like a charm.